Is CVE-2026-100304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100304 being exploited in the wild.

How severe is CVE-2026-100304?

Medium severity, with a CVSS score of 5.3, published 25 September 2026.

Which products and versions are affected?

Tduckcloud Tduck-Survey-Form 6.0.

Is there a fix for CVE-2026-100304?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100304 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100304?

Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100304: TDuck survey form information disclosure in FormAuthUtils

CVE-2026-100304 · Severity: medium · CVSS 5.3 · Published 2026-09-25

TDuck is an open-source form and questionnaire system that organizations use to collect survey responses. When a form is permanently deleted, the application fails to remove the associated submission data. An authenticated attacker can read personal information from deleted forms by requesting submission details directly if they know the submission ID, exposing user data that should have been purged.

Technologies: Tduckcloud Tduck-Survey-Form. Vendors: Tduckcloud.

Quick answers

Is CVE-2026-100304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100304 being exploited in the wild.
How severe is CVE-2026-100304?: Medium severity, with a CVSS score of 5.3, published 25 September 2026.
Which products and versions are affected?: Tduckcloud Tduck-Survey-Form 6.0.
Is there a fix for CVE-2026-100304?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100304 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100304?: Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The FormAuthUtils.hasPermission() method silently passes when a form record does not exist, creating a fail-open condition. The hard delete operation does not cascade-delete submission rows from fm_user_form_data, leaving orphaned records accessible via the GET /user/form/data/details endpoint. An authenticated attacker with a known dataId can bypass authorization checks and retrieve full submission details after the parent form has been deleted.

Affected products

TDuckCloud TDuck survey form 6.0

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.