Vulnerability Description
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/TDuckCloud/tduck-survey-form
- https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f
- https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f
- https://github.com/TDuckCloud/tduck-survey-form/issues/39
- https://www.vulncheck.com/advisories/tduck-survey-form-through-5.0-unauthorized-
FAQ
What is CVE-2026-92567?
CVE-2026-92567 is a vulnerability with a CVSS score of 6.5 (MEDIUM). TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submissi...
How severe is CVE-2026-92567?
CVE-2026-92567 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92567?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.