Authorization Bypass in TDuck Survey Form Affects User Data Management
CVE-2026-92567

7.1HIGH

Key Information:

Vendor

Tduckcloud

Status
Tduck-survey-form
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92567?

The TDuck Survey Form, up to version 5.0, has a critical vulnerability that allows authenticated users to bypass authorization controls. This occurs in the POST /user/form/data/update endpoint, enabling malicious users to modify or overwrite other users' form submission data. By exploiting predictable submission identifiers, attackers can send unauthorized update requests to manipulate personal data, resulting in potential data breaches and privacy violations.

Affected Version(s)

tduck-survey-form 0 <= 5.0

References

https://github.com/TDuckCloud/tduck-survey-form/issues/39
issue-tracking
https://github.com/TDuckCloud/tduck-survey-form
product
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.