Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck
CVE-2026-100306TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
Medium 5.3
In plain English
A medium-severity security flaw in tduck-survey-form from TDuckCloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 66.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TDuckCloud | tduck-survey-form | 0 – through 6.0 |
Weakness: CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py exploit
- https://github.com/TDuckCloud/tduck-survey-form product
- https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L154-L162 technical-description
- https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L152-L172 technical-description
- VulnCheck Advisory: TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement third-party-advisory