Missing Authorization Vulnerability in SurveyKing by JavaHuang

CVE-2026-111646

What is CVE-2026-111646?

The vulnerability in SurveyKing prior to version 1.13.0 allows attackers to exploit a missing authorization check, enabling them to download any file stored on the server using a specific API endpoint. By crafting a request with a valid attachment ID, attackers can potentially access private survey attachments and respondent data meant to be protected. This weakness arises from inadequate validation in the FileServiceImpl component, which improperly permits file access without necessary authorization checks. The issue emphasizes the importance of robust authorization mechanisms in applications that handle sensitive user data.

References