CVE-2026-109167: Authorization Bypass Through User-Controlled Key in TDuckCloud tduck-survey-form

The vulnerability exists in the saveFormTheme handler of TDuckCloud's tduck-survey-form through version 6.0. Authenticated users can exploit an insecure direct object reference to overwrite themes of other users' forms by submitting a sequential theme ID belonging to another form along with their own form key. This bypasses authorization controls and allows attackers to replace the victim's form theme colors and image URLs.

An attacker with authentication can modify the appearance of other users' forms by overwriting their themes. This could lead to unauthorized changes in form presentation, potentially causing confusion or misrepresentation of form content. There is no indication of data disclosure, privilege escalation beyond theme modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users carefully and monitor for suspicious theme modification activities. Avoid sharing form keys and consider implementing additional authorization checks on theme modification requests.