CVE-2026-100304 — TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to…
Published: 2026-09-25 · CVSS: 6.0 · CVSS 4.0
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7