CVE-2026-109165
MediumCVSS 4.3Summary
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
Risk Assessment
The risk includes unauthorized modification of other users' forms, potentially leading to manipulation of data collected from respondents and integrity issues in survey processes.
Recommendation
It is recommended to upgrade TDuck survey form to a version newer than 6.0 and implement access control on the batch/create endpoint to verify user permissions to modify the given form.
Other vulnerabilities in TDuck survey form
See all- CVE-2026-109167Medium
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
- CVE-2026-100306Medium
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
- CVE-2026-92567Medium
An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Original NVD description (English source)
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS