CVE-2026-100304
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
- Published Sep 25, 2026
- CVSS 6.0 medium
- 0.4% chance of exploitation in the next 30 days (EPSS)