PT-2026-99060 · Tduck · Tduck
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
TDuck survey form versions prior to 6.0
Description
Insufficient authorization checks exist within the
FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges to add, modify, or delete themes and theme categories, which impacts forms owned by other users.Recommendations
Update to a version newer than 6.0.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tduck