CVE-2026-100304— TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
Quick assessment
Affected
TDuckCloud tduck-survey-form
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TDuck 调查表单系统 6.0 版本中，FormAuthUtils.hasPermission 方法存在信息泄露漏洞。当请求的表单不存在时，该权限检查机制未能正确拒绝访问（即“失败时默认开放”），导致已认证的用户能够访问已删除的表单提交数据。攻击者在表单被永久删除后，通过向 GET /user/form/data/details 接口提供已知的数据 ID（dataId），即可读取孤儿化的提交数据，其中可能包含个人隐私信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100304
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
Source: CVE Program / CVE List V5
Vulnerability Description
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未能安全地进行程序失效(Failing Open)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TDuckCloud | tduck-survey-form | 6.0 | - |
|
II. Public POCs for CVE-2026-100304
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100304
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100304 (1)
Other References for CVE-2026-100304 (1)
Other References for CVE-2026-100304 (4)
Same Patch Batch · TDuckCloud · 2026-09-25 · 4 CVEs total
| CVE-2026-100303 | 5.4 MEDIUM | TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints |
| CVE-2026-100306 | 5.3 MEDIUM | TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement |
| CVE-2026-100305 | 4.3 MEDIUM | TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endp |
IV. Related Vulnerabilities
Same product: tduck-survey-form
-
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Clie -
CVE-2026-100305
TDuck survey form through 6.0 Fill-In Restriction Bypass via -
CVE-2026-100303
TDuck survey form through 6.0 Missing Authorization in Form -
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery vi -
CVE-2026-92567
TDuck survey form through 5.0 Unauthorized Data Modification
Same vendor: TDuckCloud
-
CVE-2026-100306
TDuck survey form through 6.0 Write Password Bypass via Clie -
CVE-2026-100305
TDuck survey form through 6.0 Fill-In Restriction Bypass via -
CVE-2026-100303
TDuck survey form through 6.0 Missing Authorization in Form -
CVE-2026-95829
TDuckCloud tduck-platform Pagination Inner Interceptor Mybat -
CVE-2026-92602
TDuck survey form through 5.3 Server-Side Request Forgery vi
Same weakness: CWE-636
-
CVE-2026-100860
heym before 0.0.105 Authentication Bypass via Redis Node -
CVE-2026-88831
Busybox: busybox: httpd silently fails open when ip deny rul -
CVE-2026-95848
Moquette fails open when configured authentication or author -
CVE-2026-92591
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure v -
CVE-2026-61595
djust: Multi-tenant isolation fails open on the WebSocket/SS
V. Comments for CVE-2026-100304
No comments yet