EUVD-2026-125613

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and...

CVE-2026-129153

SurveyKing versions 1.12.0 through 1.13.2 are vulnerable to an authorization bypass within the linked survey feature. The application fails to verify if the referenced linkSurveyId belongs to the caller's project. Consequently, an authenticated attacker can point a linked option at another user's...