CVE-2026-109167: TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

Q: Who can exploit this issue?

An attacker needs to be authenticated and able to submit requests to the form theme save endpoint. The impact described is limited to overwriting the themes of other users' forms.

Q: What conditions are required for a successful overwrite?

The attacker’s own form must have no theme. They submit their own formKey together with the sequential theme ID belonging to another form.

Q: What changes can an attacker make to a victim form?

A successful attack can replace the victim theme’s colours and image URLs, and can remove the victim’s existing theme.

Q: How can an organization identify potential exploitation?

Review requests to POST /user/form/theme/save for cases where the submitted formKey and theme ID do not belong to the same form owner. Also investigate forms whose theme colours or image URLs changed unexpectedly, particularly where a theme was removed.

Published Oct 12, 2026

Updated

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.

Affected Software

1 affected component

TDuck TDuck survey form<=6.0

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be authenticated and able to submit requests to the form theme save endpoint. The impact described is limited to overwriting the themes of other users' forms.

What conditions are required for a successful overwrite?

The attacker’s own form must have no theme. They submit their own formKey together with the sequential theme ID belonging to another form.

What changes can an attacker make to a victim form?

A successful attack can replace the victim theme’s colours and image URLs, and can remove the victim’s existing theme.

How can an organization identify potential exploitation?

Review requests to POST /user/form/theme/save for cases where the submitted formKey and theme ID do not belong to the same form owner. Also investigate forms whose theme colours or image URLs changed unexpectedly, particularly where a theme was removed.

CVE-2026-109167: TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for a successful overwrite?

What changes can an attacker make to a victim form?

How can an organization identify potential exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for a successful overwrite?

What changes can an attacker make to a victim form?

How can an organization identify potential exploitation?