CVE-2026-100303

Received Received - Intake

TDuck Survey Form Authorization Bypass in Form Themes

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100303

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

TDuck survey form through version 6.0 has a lack of authorization checks on FormThemeController write endpoints for global form themes and categories. This allows authenticated non-admin users to add, modify, or delete themes and theme categories that affect forms owned by other users.

Detection Guidance

This vulnerability involves missing authorization checks in TDuck survey form's FormThemeController endpoints. To detect it, inspect network traffic for unauthorized POST/PUT/DELETE requests to /FormThemeController endpoints by non-admin users. Check application logs for actions like adding, modifying, or deleting themes or categories by low-privilege users. Review database changes to themes or categories not owned by the acting user.

Impact Analysis

An authenticated non-admin user could alter themes or categories for forms they do not own, potentially changing the appearance or behavior of those forms. This could lead to unauthorized modifications, data integrity issues, or disruption of survey functionality for other users.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized changes to forms, potentially affecting data integrity and user consent. GDPR requires data integrity and user control, while HIPAA requires access controls to protect sensitive health information. Unauthorized modifications may violate these requirements.

Mitigation Strategies

Immediately restrict write access to FormThemeController endpoints to admin users only. Review user permissions to ensure non-admin users cannot modify global form themes or categories. Monitor logs for unauthorized changes to themes or categories.

Hi! I’m here to help you understand CVE-2026-100303. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70