Vulnerability

CVE-2026-100303

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 04:29

Description

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.

STIX identifiervulnerability--65e33388-aa2b-50cb-b1e6-cb373b7cff9b

First observation-

Last observation-

Known relationships8

Aliases and classifications

CWE-862Missing Authorization

Minimised technical details

No raw data

cisa kev: False
cvss score: 5.4
cvss vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
cvss severity: MEDIUM

Provenance

Public references

VulnCheck Advisory: TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-missing-authorization-in-form-theme-management-endpoints
exploit
https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_theme_write.py
product
https://github.com/TDuckCloud/tduck-survey-form
technical-description
https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormThemeController.java

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.