Live › vulnerability › CVE-2026-111646
Go to dashboardSurveyKing before 1.13.0 exposes GET /api/public/preview/{attachmentId} without authorization checks. An unauthenticated attacker who knows or can guess a snowflake file id can download private survey attachments and respondent uploads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or deployed SurveyKing instances running a version before 1.13.0 that store survey attachments or respondent uploads. Instances without uploaded files have less exposure, and the sources do not say whether managed hosting is involved.
No product ranges from the sources yet.
1.13.0.GET /api/public/preview/{attachmentId} returns files without a session, using a file id you own.1.13.0 or later./api/public/preview/ route at the proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
This page as .md · .json · in your agent: get_signal("CVE-2026-111646")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.