SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

Advisories

SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

Severity: high
Date: 10/16/2026
Affecting: SurveyKing >= 0, < 1.13.0
CVE: CVE-2026-111646
CWE: CWE-862 Missing Authorization
CVSS: 8.2
CVSS V4 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read
https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/java/cn/surveyking/server/api/SurveyApi.java#L99-L107
https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/java/cn/surveyking/server/impl/FileServiceImpl.java#L197-L228
https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4
https://github.com/javahuang/SurveyKing
Credit: hieuPenguinnn
Description: SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo