CVE-2026-100306 | BDVDB-2026-379693 Detail
TDuckCloudtduck-survey-form
Description#
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-602 Client-Side Enforcement of Server-Side Security
References#
- https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py
- https://github.com/TDuckCloud/tduck-survey-form
- https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L154-L162
- https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L152-L172
- https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-write-password-bypass-via-client-side-enforcement
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.