Medium severity · published Sep 16, 2026
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
tduck-survey-form · TDuckCloud
through 5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92567
github.com
https://github.com/TDuckCloud/tduck-survey-form
github.com
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L198-L207
github.com
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java#L158-L167
github.com
https://github.com/TDuckCloud/tduck-survey-form/issues/39
www.vulncheck.com
https://www.vulncheck.com/advisories/tduck-survey-form-through-5.0-unauthorized-data-modification
More from tduck-survey-form
7.1
CVE-2026-109164
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
7.1
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
5.4
CVE-2026-100303
TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
5.3
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
5.3
CVE-2026-100304
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check