CVE-2026-92567highCWE-639

CVE-2026-92567: falha de alta gravidade em TDuckCloud tduck-survey-form

TDuck survey form through 5.0 Unauthorized Data Modification

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar tduck-survey-form

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TDuckCloud · tduck-survey-form
CVEs relacionadas — TDuckCloud tduck-survey-form

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92602HIGHTDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URLEPSS 0.4%CVE-2026-100306MEDIUMTDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementEPSS 0.4%CVE-2026-100304MEDIUMTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckEPSS 0.4%CVE-2026-109164HIGHTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}EPSS 0.3%CVE-2026-100303MEDIUMTDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsEPSS 0.3%CVE-2026-100305MEDIUMTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission EndpointEPSS 0.3%