# CVE-2026-92602: TDuck survey form improper access control in webhook configuration

Source: https://junglewise.ai/threats/cve-2026-92602-tduck-survey-form-improper-access-control-in-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92602 · Severity: high · CVSS 7.1 · Published 2026-09-16

TDuck is an open-source form and survey platform used to collect user responses. A flaw in its webhook configuration feature allows authenticated attackers to attach webhooks to forms owned by other users, enabling them to intercept and redirect form submissions to arbitrary addresses—potentially exposing sensitive customer data to unauthorized external or internal systems.

Technologies: [Tduckcloud Tduck-Survey-Form](https://junglewise.ai/threats/technologies/tduck-survey-form). Vendors: [Tduckcloud](https://junglewise.ai/threats/vendors/tduckcloud).

## Quick answers

**Is CVE-2026-92602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92602 being exploited in the wild.

**How severe is CVE-2026-92602?** High severity, with a CVSS score of 7.1, published 16 September 2026.

**Which products and versions are affected?** Tduckcloud Tduck-Survey-Form through 5.3.

**Is there a fix for CVE-2026-92602?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92602 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92602?** Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WebhookConfigController in TDuck survey form versions through 5.3 fails to validate webhook URLs and does not verify that the authenticated user owns the form before allowing webhook configuration changes. An authenticated attacker can exploit the `/webhook/config/save` endpoint by supplying an arbitrary `sourceId` (form ID) in the request, allowing them to attach a malicious webhook URL to another user's form. When legitimate form submissions occur, the webhook will forward the submission data to an attacker-controlled address, enabling data exfiltration. The vulnerability requires authentication but no additional user interaction, and can impact any form in the system accessible through predictable or enumerable IDs.

## Affected products

- TDuckCloud tduck-survey-form through 5.3

## Timeline

- 2026-09-16: disclosed: CVE-2026-92602 published

## References

- [https://github.com/TDuckCloud/tduck-survey-form](https://github.com/TDuckCloud/tduck-survey-form)
- [https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java](https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java)

## Related threats

- [TDuck survey form insecure direct object reference in saveFormTheme](https://junglewise.ai/threats/cve-2026-109167-tduck-survey-form-through-6-0-contains-an-insecure-direct-object)
- [TDuck survey form insecure direct object reference in submission deletion](https://junglewise.ai/threats/cve-2026-109164-tduck-survey-form-through-6-0-contains-an-insecure-direct-object)
- [TDuck survey form password validation bypass in submission endpoints](https://junglewise.ai/threats/cve-2026-100306-tduck-survey-form-through-6-0-fails-to-validate-write-passwords)
- [TDuck survey form authentication bypass in form submission](https://junglewise.ai/threats/cve-2026-100305-tduck-survey-form-through-6-0-fails-to-enforce-form-fill-in)
- [TDuck survey form information disclosure in FormAuthUtils](https://junglewise.ai/threats/cve-2026-100304-tduck-survey-form-6-0-contains-an-information-disclosure)