Authenticated Users Can Delete Form Submissions via Insecure Direct Object Reference in TDuck Survey Form

Executive Summary

CVE-2026-109164 is an insecure direct object reference (IDOR) vulnerability in TDuck survey form through version 6.0. It allows authenticated users to delete other users' form submissions by manipulating submission IDs. Attackers can insert their own formKey in the URL path and iterate through sequential submission IDs in the request body to permanently delete submissions across the platform.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to the /user/form/data/delete/{formKey} endpoint. Check if requests contain sequential submission IDs in the body without proper authorization checks. Use tools like curl to test: curl -X POST -H 'Authorization: Bearer <token>' -d '{"ids":[1,2,3]}' https://<target>/user/form/data/delete/<formKey>. If deletions occur without ownership validation, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to delete other users' form submissions without authorization. If exploited, it could lead to data loss, disruption of surveys or forms, and potential reputational damage. Organizations using TDuck survey form may face operational disruptions and loss of critical form data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized deletion of user data. GDPR requires data integrity and protection, while HIPAA mandates safeguards for protected health information. Unauthorized deletions may lead to non-compliance, legal penalties, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TDuck survey form to the latest version beyond 6.0. Implement strict authorization checks to verify submission ownership before deletion. Restrict POST /user/form/data/delete/{formKey} access to authorized users only. Review logs for unauthorized deletion attempts and block suspicious IP addresses.

Useful 0 Not Useful 0