CVE-2026-92602: TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TDuck survey formto a version that resolves this vulnerability.Fixed in 5.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to TDuck. The vulnerable controller does not verify that the attacker owns the form whose webhook they configure.
What can an attacker do after exploitation?
They can attach a webhook to another user's form and cause submitted survey data to be sent to an arbitrary external or internal address. This can expose form submissions and enables server-side requests to attacker-selected destinations.
Are deployments through version 5.3 affected?
The issue is reported in TDuck survey form through version 5.3. The provided data does not identify a fixed version or whether any configuration avoids exposure.