Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109165TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in tduck-survey-form from TDuckCloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.

Affected products (as reported)

Vendor	Product	Versions
TDuckCloud	tduck-survey-form	0 – through 6.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (6.0) technical-description
VulnCheck Advisory: TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create third-party-advisory