Is CVE-2026-100303 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100303 being exploited in the wild.

How severe is CVE-2026-100303?

Medium severity, with a CVSS score of 5.4, published 25 September 2026.

Which products and versions are affected?

Tduckcloud Tduck-Survey-Form through 6.0.

Is there a fix for CVE-2026-100303?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100303 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100303?

Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100303: TDuck FormThemeController authorization bypass in form themes

CVE-2026-100303 · Severity: medium · CVSS 5.4 · Published 2026-09-25

TDuck is a survey and form system that allows organizations to create and deploy questionnaires. The vulnerability allows any authenticated user, even non-administrators, to modify, create, or delete global form themes and theme categories that affect all users' forms. This enables unauthorized users to deface forms, disrupt organizational branding, and affect availability across the entire system.

Technologies: Tduckcloud Tduck-Survey-Form. Vendors: Tduckcloud.

Quick answers

Is CVE-2026-100303 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100303 being exploited in the wild.
How severe is CVE-2026-100303?: Medium severity, with a CVSS score of 5.4, published 25 September 2026.
Which products and versions are affected?: Tduckcloud Tduck-Survey-Form through 6.0.
Is there a fix for CVE-2026-100303?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100303 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100303?: Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The FormThemeController endpoints lack authorization checks beyond basic authentication; they do not verify admin status or ownership before allowing write operations on global themes and categories. An authenticated attacker can exploit POST, PUT, and DELETE endpoints to manipulate shared form appearance resources that all users rely upon, potentially corrupting or breaking forms across the platform.

Affected products

TDuckCloud TDuck survey form through 6.0

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.