Medium severity · published Oct 12, 2026
CVE-2026-109165
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
tduck-survey-form · TDuckCloud
through 6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109165
exploit
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_form_item_batch_create_cross_form.py
technical-description
https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java#L327-L336
third-party-advisory
https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-form-key-in-post-user-form-item-batch-create
More from tduck-survey-form
7.1
CVE-2026-109164
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
7.1
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
6.5
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification
5.4
CVE-2026-100303
TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
5.3
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement