CVE-2026-100304: TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The attacker also needs to know a valid dataId for a submission belonging to a form that has been permanently deleted.
What data may be exposed?
The affected endpoint can return orphaned submission data, including personal information, from deleted forms.
Are active forms affected?
The described fail-open condition occurs when the associated form does not exist. The available information specifically identifies submissions remaining after permanent deletion of their form.
How can I check whether data is exposed?
Identify permanently deleted forms that may still have retained submission records, then test whether an authenticated account can retrieve a known associated dataId through GET /user/form/data/details.