CVE-2026-100305

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0

Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can submit unlimited entries to any form. This allows the bypass of publish status, time windows, quotas, and per-IP restrictions, enabling the falsification of collected results.

Recommendations Update to a version newer than 6.0. Restrict access to the "POST /user/form/data/create" endpoint to minimize the risk of exploitation.