Executive brief
TDuck is an open-source survey and form submission system used by enterprises to collect questionnaire responses. The vulnerability allows authenticated users to modify other users' form submission data by bypassing ownership validation on the data update endpoint, potentially exposing or corrupting sensitive personal information collected through surveys and questionnaires.
Technical details
An authorization bypass vulnerability exists in the POST /user/form/data/update endpoint of TDuck survey form through version 5.0. The vulnerable component (UserFormResultController) fails to validate ownership before allowing authenticated users to update form submission data. Attackers can enumerate submission identifiers allocated in narrow, predictable ranges and send update requests to modify arbitrary form responses without proper authorization checks. The attack requires prior authentication but no special privileges, and can result in unauthorized modification of sensitive personal data contained in survey submissions. A patch addressing the ownership validation is likely available in versions after 5.0.
Affected products
- TDuckCloud tduck-survey-form through 5.0
Timeline
- 2026-09-16: disclosed