CVE-2026-100306: TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any TDuck survey form deployment through 6.0 with a publicly shared form that relies on a write password to restrict submissions is exposed. An attacker only needs the form key available in the form's share link.
What does an attacker need to exploit it?
No authentication, password, or user interaction is required. The attacker can send a submission directly to the public submission API using the form key, bypassing the client-side password check.
Are forms protected only by a write password affected by default?
Yes. The issue exists because write-password validation is enforced in the front end rather than on the submission endpoint, so the password does not prevent direct API submissions.
How can I tell whether a form has been abused?
Review submitted entries for unexpected or unauthorized responses, particularly on forms shared publicly and configured with a write password. The provided data does not identify a specific server-side indicator that distinguishes bypassed submissions from normal ones.