CVE-2026-111646

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

An unauthenticated attacker can access private survey attachments and respondent uploads, leading to a breach of data confidentiality. The organization may face legal consequences and loss of respondent trust.

Update SurveyKing to version 1.13.0 or later. Implement authorization checks in FileServiceImpl.loadFile and restrict access to the /api/public/preview/{attachmentId} endpoint.