CVE-2026-111646

EUVD-2026-103068
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31.29%
Common Weakness Enumeration
References
https://github.com/javahuang/SurveyKing
https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/java/cn/surveyking/server/api/SurveyApi.java#L99-L107
https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/java/cn/surveyking/server/impl/FileServiceImpl.java#L197-L228
https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4
https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read
https://www.vulncheck.com/advisories/surveyking-before-1.13.0-unauthenticated-file-download-via-api-public-preview