CVE-2026-92567highCWE-639

CVE-2026-92567: high-severity vulnerability in TDuckCloud tduck-survey-form

TDuck survey form through 5.0 Unauthorized Data Modification

Published · Updated

Follow this CVE+ Monitor tduck-survey-form

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
TDuckCloud · tduck-survey-form
Related CVEs — TDuckCloud tduck-survey-form

In the same product, most dangerous first.

CVE-2026-92602HIGHTDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URLEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-100304MEDIUMTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckEPSS 0.4%CVE-2026-109164HIGHTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}EPSS 0.3%CVE-2026-100303MEDIUMTDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsEPSS 0.3%CVE-2026-100305MEDIUMTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission EndpointEPSS 0.3%