CVE-2026-111621
TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
| CWE | CWE-639 |
| Vendor | tduckcloud |
| Product | tduck-survey-form |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for tduckcloud tduck-survey-form
Be the first to know when new medium vulnerabilities affecting tduckcloud tduck-survey-form are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
TDuckCloud / tduck-survey-form
0 ≤ 5.3
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/tduck-survey-form-setting-cross-user-disclosure github.com: https://github.com/TDuckCloud/tduck-survey-form/blob/5.3/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L66-L75 github.com: https://github.com/TDuckCloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18 github.com: https://github.com/TDuckCloud/tduck-survey-form vulncheck.com: https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-missing-authorization-via-user-form-setting-key
Credits
hieuPenguinnn