TI-2026-75432 CVE-2026-111646 · GHSA-6fh4-2vv9-2fp2
Missing authorization in SurveyKing lets attackers download stored files
Priority LOW 36
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}.