CVE-2026-92567 — TDuck survey form through 5.0 Unauthorized Data Modification
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite oth…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7