CVE-2026-111646 in SurveyKing
Summary
by MITRE • 10/16/2026
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in SurveyKing versions prior to 1.13.0 represents a critical failure in access control mechanisms, specifically classified under CWE-284 as Improper Access Control. This flaw resides within the FileServiceImpl.loadFile method, which is responsible for retrieving and serving files associated with surveys and respondent data. The core technical deficiency lies in the endpoint GET /api/public/preview/{attachmentId}, which was designed to allow public previewing of attachments but lacks sufficient authorization checks before executing file retrieval operations. Because the system relies on Snowflake IDs for file identification, these identifiers are sequential or time-ordered by nature. This predictability allows attackers who can derive or guess valid attachment IDs to systematically iterate through potential identifiers and access files that should be restricted to authorized users only.
The operational impact of this vulnerability is severe due to the sensitive nature of the data typically stored in survey platforms. SurveyKing often handles personally identifiable information, confidential business responses, and other private attachments uploaded by respondents or created by project owners. By bypassing shared, owner, and project-level checks, an unauthenticated attacker can download any file for which they possess a valid ID. This leads to unauthorized disclosure of sensitive data, violating the confidentiality principle of security triads. The ability to enumerate these IDs effectively turns the vulnerability into a bulk data exfiltration risk, where attackers do not need complex exploits but rather simple automated scripts to scrape large volumes of private documents and survey responses from the system.
From an offensive security perspective, this behavior aligns with ATT&CK technique T1078, specifically Valid Accounts or Default Accounts if combined with other flaws, but more accurately maps to T1530 Data from Local System or remote data staging via unauthorized access. The lack of proper authorization checks on a public-facing API endpoint is a classic example of broken object level permissions (BOLA), which falls under CWE-639 in many modern classifications focusing on API security. Attackers exploit the trust placed in the ID parameter without verifying whether the requesting user has permission to view that specific resource instance. This misconfiguration undermines the integrity and confidentiality guarantees provided by the application's authentication layer, as the authorization logic is either missing or incorrectly implemented within the service method handling file loads.
Mitigation for this vulnerability requires immediate patching of SurveyKing to version 1.13.0 or later, where these access control checks have been corrected. For organizations unable to patch immediately, implementing a Web Application Firewall rule that restricts direct access to the /api/public/preview/ endpoint unless accompanied by valid session tokens and proper authorization headers is recommended as an interim measure. Additionally, developers should audit other API endpoints for similar patterns of missing object-level authorization checks. It is also advisable to implement rate limiting on this endpoint to prevent rapid enumeration attacks using sequential IDs, although patching remains the only definitive solution to eliminate the underlying code flaw that allows unauthorized file access regardless of input constraints.