CVE-2026-100303 — TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints

Description (CNA)

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.

Affected (CNA)

Vendor / product	Versions
TDuckCloud / tduck-survey-form	affected 0 through 6.0

CWE

CWE-862

References

https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_theme_write.py
https://github.com/TDuckCloud/tduck-survey-form
https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormThemeController.java#L61-L120
https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-missing-authorization-in-form-theme-management-endpoints

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.