CVE-2026-92567

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 5.1

Description An authorization bypass exists in the 'POST /user/form/data/update' endpoint. This issue allows authenticated users to overwrite form submission data belonging to other users. Attackers can identify submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data because the system fails to validate ownership when processing update requests.

Recommendations Update TDuck survey form to version 5.1 or later. As a temporary mitigation, restrict access to the 'POST /user/form/data/update' endpoint.