CVE-2026-109167
MediumCVSS 4.3Summary
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
Risk Assessment
The risk includes unauthorized modification of other users' data (form themes), potentially leading to data integrity issues and disruption of form functionality.
Recommendation
It is recommended to upgrade TDuck survey form to a version newer than 6.0 and add ownership validation in the saveFormTheme handler to prevent overwriting others' themes.
Other vulnerabilities in TDuck survey form
See all- CVE-2026-109165Medium
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
- CVE-2026-100306Medium
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
- CVE-2026-92567Medium
An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Original NVD description (English source)
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS