PT-2026-99060

CVE-2026-100303

Published

2026-09-25

Updated

2026-09-30

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0

Description Insufficient authorization checks exist within the FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges to add, modify, or delete themes and theme categories, which impacts forms owned by other users.

Recommendations Update to a version newer than 6.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Mingsheng Lin

Yaqi Chao

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization