CVE-2026-92567: TDuck survey form through 5.0 Unauthorized Data Modification
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TDuck survey formto a version that resolves this vulnerability.Fixed in 5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated TDuck survey form user can exploit it. The attacker does not need to own the targeted submission because the update endpoint does not validate ownership.
What does an attacker need to modify another user's submission?
The attacker needs a valid account and a target submission identifier. Submission identifiers may be discoverable because they are allocated in narrow ranges.
Are systems exposed by default?
The affected POST /user/form/data/update endpoint is vulnerable through TDuck survey form version 5.0 when authenticated users can reach it. The provided information does not identify a configuration prerequisite or mitigation setting.
How can I determine whether this has been exploited?
Review requests to POST /user/form/data/update for updates where the authenticated user differs from the owner of the modified form submission. Also investigate modifications involving unexpected or sequentially adjacent submission identifiers.