CVE-2026-100304

Name of the Vulnerable Software and Affected Versions TDuck survey form version 6.0

Description An information disclosure issue exists in the hasPermission() function of FormAuthUtils. The system fails open when a form does not exist, which allows authenticated users to access deleted form submissions. By providing a known dataId to the 'GET /user/form/data/details' endpoint after a form has been permanently deleted, attackers can read orphaned submission data, including personal information.

Recommendations Update TDuck survey form to a version newer than 6.0. As a temporary mitigation, restrict access to the 'GET /user/form/data/details' endpoint.