SurveyKing: Missing authorization allows unauthenticated file download
Summary
SurveyKing, a self-hosted survey and exam platform, contains a missing authorization flaw in the public preview endpoint. An unauthenticated attacker who knows or can derive the time-ordered file ID can download stored files, including private survey attachments and respondent uploads, because the ownership, sharing and project checks are bypassed. The attack requires no account, but the attacker must know or derive a valid file ID.
Affected
- SurveyKing versions before 1.13.0 (affected range 0 to < 1.13.0, per the CVE record)
Fixed in
- Fixed in SurveyKing 1.13.0 (fix commit 9489171d53e55ace2856a91af38034665c0064a4)
- No backport to earlier versions has been identified.
Workaround
- Restrict access to the instance (VPN, IP allowlist or authenticated reverse proxy) until the upgrade is complete.
- A third-party suggestion is to block the /api/public/preview path in a web application firewall unless a valid session is present. This is not a vendor recommendation and its effectiveness is unverified.
Exploitation
- No evidence of active exploitation found; CISA KEV status not checked.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Third-party write-ups exist, but their content could not be verified.
- EPSS 0.00385 (low).
Our recommendation
- Check whether SurveyKing is installed and which version runs; upgrade to 1.13.0 or later.
- If the instance is internet-facing and not needed publicly, restrict access now.
- Review which files are stored and whether they contain personal data; assess data protection obligations if exposure is confirmed.
- Review access logs for unusual requests to /api/public/preview.
- Note that several public forks exist; confirm the build in use includes the fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-111646 on VulDB vuldb.com
- Strix CVE-2026-111646 www.strix.ai
- VulnCheck advisory www.vulncheck.com
- Fix commit 9489171d github.com
- SurveyApi.java (vulnerable preview endpoint) github.com
- FileServiceImpl.java (loadFile) github.com
- SurveyKing on GitHub github.com
- OSV CVE-2026-111646 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:52.
Original description (NVD)
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
NVD references (6)
- https://github.com/javahuang/SurveyKing
- https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/jav…
- https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/j…
- https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4
- https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read
- https://www.vulncheck.com/advisories/surveyking-before-1.13.0-unauthenticated-file-download-via-api-public-pr…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.