CVE-2026-111646 javahuang CVE debrief

Who should care

Defenders responsible for SurveyKing deployments, especially those handling sensitive survey data, should assess exposure and potential impact. This includes administrators, security teams, and developers working with SurveyKing.

Why it matters

CVE-2026-111646 is a high-severity vulnerability in SurveyKing that allows unauthenticated attackers to download files by ID. Defenders should prioritize verifying exposure, assessing impact, and implementing mitigations to prevent unauthorized data access.

• Potential unauthorized access to sensitive survey data.
• Risk of data breaches due to missing authorization checks.
• Need for verification of SurveyKing version and exposure.
• Potential impact on confidentiality and integrity of survey data.

Technical summary

The vulnerability exists in the FileServiceImpl.loadFile method, which fails to properly check permissions when loading files by ID. This allows attackers to bypass shared, owner, and project checks and download private survey attachments and respondent uploads. Affected SurveyKing deployments should verify exposure, assess potential impact, and implement mitigations to prevent unauthorized data access. Defenders should prioritize verifying exposure of SurveyKing instances, especially those handling sensitive survey data, and assess the impact of potential unauthorized file downloads.

Defensive priority

Defenders should prioritize verifying exposure of SurveyKing instances, especially those handling sensitive survey data, and assess the impact of potential unauthorized file downloads.

Recommended defensive actions

• Verify the version of SurveyKing in use and check if it is vulnerable (less than 1.13.0).
• Restrict access to the /api/public/preview/{attachmentId} endpoint to authenticated users only.
• Implement additional monitoring to detect potential unauthorized file downloads.
• Consider upgrading to SurveyKing version 1.13.0 or later.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source references provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected deployments and the number of potential victims are unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.