HIGHCVSS v3.1 7.1Vulnerability
CVE-2026-129153
SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.1
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 7.1
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-129153
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- First seen by Signal
- 2026-11-13T20:38:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Published at
- 2026-11-13T18:17:39.683
- Last modified
- 2026-11-13T18:17:39.833
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph