CVE-2026-92602

TDuck survey form through version 5.3 contains a server-side request forgery and broken-access-control flaw (CWE-918) in its WebhookConfigController, which neither validates the webhook URL supplied nor verifies that the requesting user owns the target form. An authenticated attacker with a low-privilege account can attach a webhook pointing to an arbitrary external or internal address to another user's form. When victims then submit that form, their submission data is pushed to the attacker-controlled URL, enabling data exfiltration, and the server can be made to send requests to internal network addresses. Any organization running a TDuck deployment at version 5.3 or earlier, particularly multi-user deployments, is affected. No public proof-of-concept, CISA KEV listing, or confirmed exploitation has been reported as of this analysis.

What to do: Upgrade TDuck to a patched release as soon as the vendor publishes one (no fixed version is specified in the available data), and in the meantime restrict which authenticated roles can create or modify webhooks. Audit existing webhook configurations for entries on forms you did not create, apply egress filtering so the TDuck server cannot reach unexpected internal or external hosts, and remove or disable the webhook feature for untrusted users until the ownership check is fixed.