CVE-2026-109165: fallo de gravedad media en TDuckCloud tduck-survey-form
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
Publicada el · Actualizada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.2%
probabilidad de explotación
0.2%top 85% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
TDuckCloud · tduck-survey-formPoCs públicas encontradas — 1
cve_referencegithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_form_item_batch_create_cross_form.pyno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — TDuckCloud tduck-survey-form
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-92567HIGHTDuck survey form through 5.0 Unauthorized Data ModificationEPSS 0.4%CVE-2026-92602HIGHTDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URLEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-100304MEDIUMTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckEPSS 0.4%CVE-2026-109164HIGHTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}EPSS 0.3%CVE-2026-100303MEDIUMTDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsEPSS 0.3%
Referencias
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_form_item_batch_create_cross_form.pyhttps://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java#L327-L336https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-form-key-in-post-user-form-item-batch-create