Broken Access Control in TDuck Survey Form

Executive Summary

CVE-2026-109165 is a broken access control vulnerability in TDuck survey form through version 6.0. It allows authenticated users to inject form fields into other users' forms via the POST /user/form/item/batch/create endpoint. Attackers exploit this by submitting an array where the first element references their own form and subsequent elements reference a victim's form key, bypassing permission checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor POST requests to /user/form/item/batch/create. Check for arrays where the first element references the attacker's form followed by the victim's form key. Verify if unauthorized form fields appear on public forms.

Useful 0 Not Useful 0

Impact Analysis

If you are a TDuck survey form user, an attacker could inject malicious or unwanted fields into your public forms. This could alter your forms' functionality, expose sensitive data, or mislead respondents. The impact is limited to authenticated users exploiting the batch creation endpoint.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized modifications of forms containing sensitive data, potentially violating GDPR (data protection) or HIPAA (healthcare data privacy) by exposing or altering protected information. Compliance may be impacted if forms handle regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TDuck survey form to the latest version beyond 6.0. Implement strict input validation for form keys in batch creation endpoints. Review and restrict POST /user/form/item/batch/create access to authorized users only.

Useful 0 Not Useful 0