{"schema":"threatline.record/2","record":{"id":"CVE-2026-111646","aliases":[],"summary":"SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview","details":"SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.","categories":["Unclassified"],"product":"SurveyKing","vendor":"javahuang","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111646","source_modified_at":"2026-10-16T21:18:43.318Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"SurveyKing","vendor":"javahuang","versions":[{"version":"0","lessThan":"1.13.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111646","source_modified_at":"2026-10-16T21:18:43.318Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"SurveyKing","ecosystem":null},"version":"1.13.0","basis":"first unaffected version stated in the CVE record"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00385,"percentile":0.31366,"score_date":"2026-10-23"},"published_at":"2026-10-16T17:39:15.125Z","modified_at":"2026-10-16T21:18:43.318Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111646","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T21:18:43.318Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111646","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/java/cn/surveyking/server/api/SurveyApi.java#L99-L107","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/java/cn/surveyking/server/impl/FileServiceImpl.java#L197-L228","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4","tags":["patch"]},{"source":"CVE List","url":"https://github.com/javahuang/SurveyKing","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/surveyking-before-1.13.0-unauthenticated-file-download-via-api-public-preview","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T19:34:01.319103Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T21:18:43.318Z","content_hash":"08077edd226ce3f11d7eaf8d64055e6730cf7751385bda181d4ea64a61fbf76b"}}