Executive brief
TDuck is an open-source form and survey platform used to collect user responses. A flaw in its webhook configuration feature allows authenticated attackers to attach webhooks to forms owned by other users, enabling them to intercept and redirect form submissions to arbitrary addresses—potentially exposing sensitive customer data to unauthorized external or internal systems.
Technical details
The WebhookConfigController in TDuck survey form versions through 5.3 fails to validate webhook URLs and does not verify that the authenticated user owns the form before allowing webhook configuration changes. An authenticated attacker can exploit the `/webhook/config/save` endpoint by supplying an arbitrary `sourceId` (form ID) in the request, allowing them to attach a malicious webhook URL to another user's form. When legitimate form submissions occur, the webhook will forward the submission data to an attacker-controlled address, enabling data exfiltration. The vulnerability requires authentication but no additional user interaction, and can impact any form in the system accessible through predictable or enumerable IDs.
Affected products
- TDuckCloud tduck-survey-form through 5.3
Timeline
- 2026-09-16: disclosed: CVE-2026-92602 published