CVE-2026-100304

Received Received - Intake

TDuck Form 6.0 Information Disclosure via Orphaned Submissions

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100304

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

Executive Summary

TDuck survey form 6.0 has an information disclosure vulnerability in the FormAuthUtils.hasPermission function. When a form is deleted, the system fails to properly restrict access, allowing authenticated users to view orphaned submission data by providing a known dataId to the GET /user/form/data/details endpoint. This exposes personal information from deleted forms.

Detection Guidance

To detect this vulnerability, monitor access logs for GET requests to /user/form/data/details with known dataId values after forms have been deleted. Check for unauthorized access to orphaned submission data by authenticated users.

Impact Analysis

If you use TDuck survey form 6.0, attackers with authenticated access could read personal data from forms you deleted. This includes sensitive information like names, email addresses, or survey responses. The impact depends on the type of data collected in the forms.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires proper data deletion and protection, while HIPAA mandates safeguards for protected health information. The flaw violates these standards by exposing deleted data.

Mitigation Strategies

Immediately update TDuck survey form to the latest version. Review and restrict access permissions to the /user/form/data/details endpoint. Implement strict validation to ensure forms exist before allowing data access.

Hi! I’m here to help you understand CVE-2026-100304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70