CVE-2026-111621: Authorization Bypass Through User-Controlled Key in TDuckCloud tduck-survey-form

CVE-2026-111621 describes a missing authorization vulnerability in TDuck Survey Form through version 5.3. Authenticated users can exploit the GET /user/form/setting/{key} endpoint by providing the 8-character form key, which is publicly available via fill links, to retrieve sensitive form configuration data belonging to other users. This includes the form write password, owner notification email addresses, and WeChat openIds, potentially compromising form security and user privacy.

The vulnerability allows authenticated users to bypass authorization controls and access sensitive configuration data of other users' forms. Exposure of form write passwords can lead to unauthorized modification of forms. Disclosure of owner notification emails and WeChat openIds may result in privacy violations or targeted phishing attacks. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious use of the GET /user/form/setting/{key} endpoint. Avoid sharing public fill links containing the form key to reduce exposure risk.