CVE-2026-111646: SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

Q: Which deployments are exposed?

SurveyKing versions before 1.13.0 are affected. The vulnerable endpoint is publicly reachable and does not require authentication.

Q: What does an attacker need to retrieve a private attachment?

An attacker needs a stored file's attachment ID, or the ability to derive it from SurveyKing's time-ordered snowflake IDs. No account, shared-file access, ownership, or project membership is required.

Q: What data can be accessed?

An attacker can download stored files, including private survey attachments and respondent uploads, through GET /api/public/preview/{attachmentId}.

Published Oct 16, 2026

Updated

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

Affected Software

1 affected component

SurveyKing SurveyKing<1.13.0

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

SurveyKing versions before 1.13.0 are affected. The vulnerable endpoint is publicly reachable and does not require authentication.

What does an attacker need to retrieve a private attachment?

An attacker needs a stored file's attachment ID, or the ability to derive it from SurveyKing's time-ordered snowflake IDs. No account, shared-file access, ownership, or project membership is required.

What data can be accessed?