CVE-2026-111621 — TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/settin…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7