CVE-2026-109167mediumCWE-639

CVE-2026-109167: fallo de gravedad media en TDuckCloud tduck-survey-form

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear tduck-survey-form

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.2%
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
TDuckCloud · tduck-survey-form
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — TDuckCloud tduck-survey-form

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-92567HIGHTDuck survey form through 5.0 Unauthorized Data ModificationEPSS 0.4%CVE-2026-92602HIGHTDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URLEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-100304MEDIUMTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckEPSS 0.4%CVE-2026-109164HIGHTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}EPSS 0.3%CVE-2026-100303MEDIUMTDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsEPSS 0.3%