SurveyKing CVE-2026-111646

Exploitation targets the specific endpoint GET /api/public/preview/{attachmentId}, which is exposed without authentication in SurveyKing versions before 1.13.0 because FileServiceImpl.loadFile does not enforce shared, owner, or project authorization. The key LIMITING factor is that there is no file-listing capability, so an attacker must know or derive valid file identifiers; these are snowflake IDs that are time-ordered and thus partially predictable (reflected as AC:H/AT:P in the CVSS 4.0 vector), which raises exploitation difficulty for a specific targeted file. No authentication, user interaction, or non-default configuration is required - the endpoint is public by design - but successful retrieval depends on resolving a valid attachment ID and on the instance being network-reachable.

This is a genuine but conditionally-gated confidentiality risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H) and the 8.2 score correctly capture the core tension: the endpoint is network-reachable and fully unauthenticated (PR:N/UI:N), but exploitation is NOT trivial because AC:H and AT:P reflect the real precondition that an attacker must know or derive time-ordered snowflake file IDs to pull a specific attachment, since there is no listing primitive. Impact is confidentiality-only (VI:N/VA:N) - the flaw reads files, it does not modify or deny. There is no EPSS score, no CISA KEV listing, and no vendor/CISA claim of active exploitation in the provided data, so there is no evidence of in-the-wild use. A third-party technical write-up (hackmd) and a VulnCheck advisory document the mechanism, which raises the practical likelihood that working exploitation will appear even though no packaged exploit is indicated in the input. Net: prioritize patching for anyone running SurveyKing with sensitive respondent uploads, but this is a targeted/opportunistic data-read issue, not a wormable RCE; the AC:H/AT:P snowflake-ID requirement is the main brake on real-world risk.

An unauthenticated attacker enumerates or predicts snowflake attachment IDs (which are time-ordered and therefore partially guessable) and issues GET /api/public/preview/{attachmentId} requests against an internet-facing SurveyKing instance, retrieving private survey attachments and respondent file uploads without any login. Because FileServiceImpl.loadFile omits the shared/owner/project authorization checks, each valid ID returns the file directly. A public technical write-up describes the technique, though no packaged exploit tool is indicated in the input; the main difficulty is the AC:H/AT:P requirement to derive valid IDs.