CVE-2026-109164: TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

Q: Who can exploit this issue?

Any authenticated TDuck user with the ability to send requests to the form-submission deletion endpoint can exploit it. The attacker does not need to interact with another user's account or obtain that user's submission identifiers in advance if IDs can be iterated sequentially.

Q: What does an attacker need to provide?

The attacker supplies a formKey they control in the request path and arbitrary submission IDs in the request body. By trying sequential IDs, they can target submissions belonging to other users.

Q: What is the impact of successful exploitation?

An attacker can permanently delete form submissions across the platform. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.

Q: How can administrators look for exploitation attempts?

Review requests to POST /user/form/data/delete/{formKey} for deletion requests whose submission IDs do not belong to the authenticated user or to the form identified by the path. Sequential or bulk submission-ID patterns are particularly suspicious.

Published Oct 12, 2026

Updated

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.

Affected Software

1 affected component

TDuck TDuck survey form<=6.0

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated TDuck user with the ability to send requests to the form-submission deletion endpoint can exploit it. The attacker does not need to interact with another user's account or obtain that user's submission identifiers in advance if IDs can be iterated sequentially.

What does an attacker need to provide?

The attacker supplies a formKey they control in the request path and arbitrary submission IDs in the request body. By trying sequential IDs, they can target submissions belonging to other users.

What is the impact of successful exploitation?

An attacker can permanently delete form submissions across the platform. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.

How can administrators look for exploitation attempts?

Review requests to POST /user/form/data/delete/{formKey} for deletion requests whose submission IDs do not belong to the authenticated user or to the form identified by the path. Sequential or bulk submission-ID patterns are particularly suspicious.

CVE-2026-109164: TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to provide?

What is the impact of successful exploitation?

How can administrators look for exploitation attempts?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to provide?

What is the impact of successful exploitation?

How can administrators look for exploitation attempts?