CVE-2026-92567

TDuck survey form through version 5.0 contains an authorization bypass (CWE-639) in the POST /user/form/data/update endpoint, which fails to verify that the authenticated caller owns the targeted form submission. Because submission identifiers are allocated in narrow, predictable ranges, an authenticated user can enumerate other users' submission IDs and send update requests that overwrite arbitrary form responses, including responses containing personal data. The flaw requires only low-privilege authenticated access with no user interaction, and per the CVSS score the impact is to data integrity rather than confidentiality. Any organization running TDuck 5.0 or earlier is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the vulnerability is not listed in CISA's KEV.

What to do: Deploy a fixed TDuck release as soon as the vendor publishes one, and in the meantime restrict access to the POST /user/form/data/update endpoint to trusted, minimal user roles. Audit form submission records for unauthorized modifications and review access logs for authenticated users issuing update requests against submission IDs they do not own, particularly patterns of sequential ID enumeration.