CVE-2026-111646
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated…
- Risk score
- 42/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.lo…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.13.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.9 medium
References
- https://github.com/javahuang/SurveyKing
- https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/java/cn/surveyking/server/api/SurveyApi.java#L99-L107
- https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/java/cn/surveyking/server/impl/FileServiceImpl.java#L197-L228
- https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4
- https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read
- https://www.vulncheck.com/advisories/surveyking-before-1.13.0-unauthenticated-file-download-via-api-public-preview
Original description
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
Last activity 16 Oct 2026. Patch Forecast updates every hour.