CVE-2026-111621mediumCWE-639

CVE-2026-111621: falha de média gravidade em TDuckCloud tduck-survey-form

TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

Publicada em

Seguir esta CVE+ Monitorar tduck-survey-form

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TDuckCloud · tduck-survey-form
CVEs relacionadas — TDuckCloud tduck-survey-form

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92567HIGHTDuck survey form through 5.0 Unauthorized Data ModificationEPSS 0.4%CVE-2026-92602HIGHTDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URLEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-100304MEDIUMTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckEPSS 0.4%CVE-2026-109164HIGHTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}EPSS 0.3%CVE-2026-100303MEDIUMTDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsEPSS 0.3%