javahuang CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH javahuang CVE published 2026-10-16

CVE-2026-111646

CVE-2026-111646 is a missing authorization vulnerability in SurveyKing before version 1.13.0. This vulnerability allows unauthenticated attackers to download any stored file by ID through a GET request to /api/public/preview/{attachmentId}. Attackers who know or can derive time-ordered snowflake file IDs can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attach [truncated]