CVE-2026-92567
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Risk Assessment
The risk involves the ability to manipulate personal data collected in forms, which could lead to data integrity breaches, privacy violations, and potential legal consequences.
Recommendation
Upgrade TDuck survey form to the latest patched version, implement ownership validation mechanisms before saving, and restrict access to this endpoint to authorized users only.
Other vulnerabilities in TDuck survey form
See all- CVE-2026-109167Medium
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
- CVE-2026-109165Medium
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
- CVE-2026-100306Medium
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Original NVD description (English source)
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS