Medium severity · published Sep 25, 2026
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
tduck-survey-form · TDuckCloud
through 6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100306
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100306
exploit
https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py
product
https://github.com/TDuckCloud/tduck-survey-form
technical-description
https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L154-L162
technical-description
https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L152-L172
third-party-advisory
https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-write-password-bypass-via-client-side-enforcement
More from tduck-survey-form
7.1
CVE-2026-109164
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
7.1
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
6.5
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification
5.4
CVE-2026-100303
TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
5.3
CVE-2026-100304
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check