Vulnerability Description
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/TDuckCloud/tduck-survey-form
- https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f
- https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f
- https://github.com/TDuckCloud/tduck-survey-form/issues/40
- https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-r
FAQ
What is CVE-2026-92602?
CVE-2026-92602 is a vulnerability with a CVSS score of 7.1 (HIGH). TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfi...
How severe is CVE-2026-92602?
CVE-2026-92602 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92602?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.