CVE-2026-100303

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.

  • Published Sep 25, 2026
  • CVSS 5.3 medium
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-100303 at the National Vulnerability Database