Description
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Published: 2026-09-25
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Title TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
Weaknesses CWE-602
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-25T18:47:40.936Z

Reserved: 2026-09-25T18:19:39.535Z

Link: CVE-2026-100306

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T19:16:51.167

Modified: 2026-09-25T19:16:51.167

Link: CVE-2026-100306

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T20:45:17Z

Weaknesses
  • CWE-602

    Client-Side Enforcement of Server-Side Security