CVE-2026-92602highCWE-918

CVE-2026-92602: high-severity vulnerability in TDuckCloud tduck-survey-form

TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

Published · Updated

Follow this CVE+ Monitor tduck-survey-form

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
TDuckCloud · tduck-survey-form
Related CVEs — TDuckCloud tduck-survey-form

In the same product, most dangerous first.

CVE-2026-92567HIGHTDuck survey form through 5.0 Unauthorized Data ModificationEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-100304MEDIUMTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckEPSS 0.4%CVE-2026-109164HIGHTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}EPSS 0.3%CVE-2026-100303MEDIUMTDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsEPSS 0.3%CVE-2026-100305MEDIUMTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission EndpointEPSS 0.3%