CVE-2026-111621
MediumCVSS 4.3Summary
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
Risk Assessment
Leakage of sensitive form settings — write passwords, e-mail addresses, and WeChat identifiers. Can lead to unauthorized form modification and owner privacy violations.
Recommendation
Upgrade TDuck Survey Form beyond 5.3 once available and implement authorization checks in the GET /user/form/setting/{key} endpoint. Until a fix is released, consider restricting access to this endpoint.
Other vulnerabilities in TDuck Survey Form
See all- CVE-2026-109167Medium
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
- CVE-2026-109165Medium
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
- CVE-2026-100306Medium
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
- CVE-2026-92567Medium
An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Original NVD description (English source)
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS