Is CVE-2026-111621 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111621 being exploited in the wild.

How severe is CVE-2026-111621?

Medium severity, with a CVSS score of 4.3, published 16 October 2026.

Which products and versions are affected?

Tduckcloud Survey Form through 5.3.

Is there a fix for CVE-2026-111621?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111621 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111621?

Check whether you run Tduckcloud Survey Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111621: TDuck Survey Form authorization bypass in form settings API

CVE-2026-111621 · Severity: medium · CVSS 4.3 · Published 2026-10-16

TDuck Survey Form is an open-source questionnaire and form system used by enterprises. An authenticated user can retrieve other users' form settings—including write passwords, owner notification emails, and WeChat IDs—by querying the form settings API with a publicly visible 8-character form key, leading to account compromise and unauthorized access.

Vendors: Tduckcloud.

Quick answers

Is CVE-2026-111621 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111621 being exploited in the wild.
How severe is CVE-2026-111621?: Medium severity, with a CVSS score of 4.3, published 16 October 2026.
Which products and versions are affected?: Tduckcloud Survey Form through 5.3.
Is there a fix for CVE-2026-111621?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111621 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111621?: Check whether you run Tduckcloud Survey Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GET /user/form/setting/{key} endpoint lacks proper authorization checks and returns raw form settings to any authenticated user, not just the form owner. An attacker with valid credentials can enumerate form keys from public survey links and retrieve sensitive configuration data including write passwords, notification addresses, and third-party identifiers. The vulnerability is a classic broken access control flaw requiring only authentication, not elevated privileges.

Affected products

TDuckCloud Survey Form through 5.3

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.