SurveyKing before version 1.13.0 has a missing authorization check that enables an attacker who is not logged in to retrieve any attachment by its ID through the public preview API endpoint. The flaw is a classic Missing Authorization weakness (CWE‑862) where the service does not enforce access control on the requested file, allowing private survey attachments and respondent uploads to be read if the attacker can guess or derive the Snowflake‑style file identifiers.

The vulnerability affects any deployment of the SurveyKing application running a version earlier than 1.13.0. This includes the open‑source project hosted under the JavaHuang/SurveyKing GitHub repository. No specific sub‑versions are listed beyond the pre‑1.13.0 threshold, so all releases prior to that should be assumed vulnerable.

The flaw carries a CVSS score of 8.2, indicating high severity, but there is no EPSS data available and it has not yet been listed in the CISA KEV catalog. Attackers would need to discover a valid attachment ID, which may be possible through the sequential nature of Snowflake IDs or additional information disclosure. Once an id is known, a simple HTTP GET request to /api/public/preview/{attachmentId} can return the file contents, exposing confidential survey data without authentication. Because the endpoint is publicly reachable, the likelihood of exploitation is significant if users expose internal URLs or do not restrict network access.