CVE-2026-100303— TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
Quick assessment
Affected
TDuckCloud tduck-survey-form
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TDuck 调查表单系统在版本 6.0 及之前版本中，存在对全局表单主题和类别的 FormThemeController 写入接口的权限检查缺失问题。已认证的普通用户（非管理员）可以添加、修改或删除主题及主题类别，进而影响其他用户所拥有的表单。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100303
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TDuckCloud | tduck-survey-form | 0 ~ 6.0 | - |
|
II. Public POCs for CVE-2026-100303
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100303
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100303 (1)
Other References for CVE-2026-100303 (1)
Other References for CVE-2026-100303 (2)
Same Patch Batch · TDuckCloud · 2026-09-25 · 4 CVEs total
| CVE-2026-100304 | 5.3 MEDIUM | TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check |
| CVE-2026-100306 | 5.3 MEDIUM | TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement |
| CVE-2026-100305 | 4.3 MEDIUM | TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endp |
IV. Related Vulnerabilities
Same product: tduck-survey-form
-
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Clie -
CVE-2026-100305
TDuck survey form through 6.0 Fill-In Restriction Bypass via -
CVE-2026-100304
TDuck survey form 6.0 Information Disclosure via Fail-Open F -
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery vi -
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification
Same vendor: TDuckCloud
-
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Clie -
CVE-2026-100305
TDuck survey form through 6.0 Fill-In Restriction Bypass via -
CVE-2026-100304
TDuck survey form 6.0 Information Disclosure via Fail-Open F -
CVE-2026-95829
TDuckCloud tduck-platform Pagination Inner Interceptor Mybat -
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery vi
Same weakness: CWE-862
-
CVE-2026-86335
LXD Cross-Project Private Image Theft via Unsanitized GetIma -
CVE-2026-82377
Apache Roller: Missing weblog authorization in XML-RPC Blogg -
CVE-2026-101000
Netcore NBR100V2 ACL unauthenticated.json uci.apply authoriz -
CVE-2026-96283
Flatpak: flatpak: flatpak-system-helper cross-user cancelpul -
CVE-2026-101063
Obot before v0.23.0 Authentication Bypass via Registry API
V. Comments for CVE-2026-100303
No comments yet