# CVE-2026-100305: TDuck survey form authentication bypass in form submission

Source: https://junglewise.ai/threats/cve-2026-100305-tduck-survey-form-through-6-0-fails-to-enforce-form-fill-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100305 · Severity: medium · CVSS 4.3 · Published 2026-09-25

TDuck is an open-source questionnaire and survey platform used by enterprises to collect form responses. Authenticated attackers can exploit a flaw in the form submission endpoint to inject unlimited fake survey responses into any form, bypassing configured restrictions like submission quotas, time windows, and IP filters. This allows attackers to falsify survey results and corrupt the integrity of collected data.

Technologies: [Tduckcloud Tduck-Survey-Form](https://junglewise.ai/threats/technologies/tduck-survey-form). Vendors: [Tduckcloud](https://junglewise.ai/threats/vendors/tduckcloud).

## Quick answers

**Is CVE-2026-100305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100305 being exploited in the wild.

**How severe is CVE-2026-100305?** Medium severity, with a CVSS score of 4.3, published 25 September 2026.

**Which products and versions are affected?** Tduckcloud Tduck-Survey-Form through 6.0.

**Is there a fix for CVE-2026-100305?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100305 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100305?** Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The POST /user/form/data/create endpoint fails to invoke the getUserFormWriteSettingStatus validation function, unlike the public submission endpoint POST /user/form/data/public/create, allowing authenticated attackers with knowledge of a form's key to bypass publish status, time window, quota, and per-IP restrictions. The write password is also never validated server-side on the authenticated path. An attacker gains the ability to inject arbitrary form submissions to any form they have access to.

## Affected products

- TDuckCloud tduck-survey-form through 6.0

## Timeline

- 2026-09-25: disclosed

## References

- [https://github.com/TDuckCloud/tduck-survey-form](https://github.com/TDuckCloud/tduck-survey-form)
- [https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py](https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py)

## Related threats

- [TDuck survey form insecure direct object reference in saveFormTheme](https://junglewise.ai/threats/cve-2026-109167-tduck-survey-form-through-6-0-contains-an-insecure-direct-object)
- [TDuck survey form insecure direct object reference in submission deletion](https://junglewise.ai/threats/cve-2026-109164-tduck-survey-form-through-6-0-contains-an-insecure-direct-object)
- [TDuck survey form password validation bypass in submission endpoints](https://junglewise.ai/threats/cve-2026-100306-tduck-survey-form-through-6-0-fails-to-validate-write-passwords)
- [TDuck survey form information disclosure in FormAuthUtils](https://junglewise.ai/threats/cve-2026-100304-tduck-survey-form-6-0-contains-an-information-disclosure)
- [TDuck FormThemeController authorization bypass in form themes](https://junglewise.ai/threats/cve-2026-100303-tduck-survey-form-through-6-0-lacks-authorization-checks-on)