CVE-2026-92567: Authorization Bypass Through User-Controlled Key in TDuckCloud tduck-survey-form
TDuckCloud tduck-survey-form versions up to 5.0 have an authorization bypass vulnerability in the POST /user/form/data/update endpoint. Authenticated users can overwrite other users' form submission data by exploiting predictable submission identifiers. This allows modification of arbitrary form responses containing personal data without proper ownership validation.
AI Analysis
Technical Summary
CVE-2026-92567 describes an authorization bypass vulnerability in TDuckCloud's tduck-survey-form product through version 5.0. The flaw exists in the POST /user/form/data/update endpoint, where authenticated users can send update requests with user-controlled keys to overwrite other users' form submission data. The vulnerability arises because submission identifiers are allocated in narrow ranges, making it feasible for attackers to discover and manipulate arbitrary form responses without ownership checks.
Potential Impact
An attacker with authenticated access can modify other users' form submission data, potentially altering personal or sensitive information. This compromises data integrity and privacy within the affected application. There is no indication of remote code execution or denial of service, but the unauthorized data modification risk is significant.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious update requests. Implement additional server-side ownership validation on form submission updates to prevent unauthorized modifications.
CVE-2026-92567: Authorization Bypass Through User-Controlled Key in TDuckCloud tduck-survey-form
Description
TDuckCloud tduck-survey-form versions up to 5.0 have an authorization bypass vulnerability in the POST /user/form/data/update endpoint. Authenticated users can overwrite other users' form submission data by exploiting predictable submission identifiers. This allows modification of arbitrary form responses containing personal data without proper ownership validation.
CVSS v4.0
Score 7.1high
Affected software
TDuckCloud
tduck-survey-form
pkg:github/tduckcloud/tduck-survey-formRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92567 describes an authorization bypass vulnerability in TDuckCloud's tduck-survey-form product through version 5.0. The flaw exists in the POST /user/form/data/update endpoint, where authenticated users can send update requests with user-controlled keys to overwrite other users' form submission data. The vulnerability arises because submission identifiers are allocated in narrow ranges, making it feasible for attackers to discover and manipulate arbitrary form responses without ownership checks.
Potential Impact
An attacker with authenticated access can modify other users' form submission data, potentially altering personal or sensitive information. This compromises data integrity and privacy within the affected application. There is no indication of remote code execution or denial of service, but the unauthorized data modification risk is significant.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious update requests. Implement additional server-side ownership validation on form submission updates to prevent unauthorized modifications.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T13:34:38.760Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aaaabfd55bf5e2cf5bf8d4c
Added to database: 09/16/2026, 14:47:25 UTC
Last enriched: 09/16/2026, 15:01:43 UTC
Last updated: 09/16/2026, 16:17:04 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.