CVE-2026-100304: TDuck Survey Form Information Disclosure

CVE-2026-100304 Overview

CVE-2026-100304 is an information disclosure vulnerability affecting TDuck survey form version 6.0. The flaw resides in the FormAuthUtils.hasPermission function, which fails open when a referenced form no longer exists. Authenticated users can supply a known dataId to the GET /user/form/data/details endpoint and retrieve submission records tied to deleted forms. The exposed data includes personally identifiable information collected through orphaned survey submissions. The vulnerability maps to [CWE-636: Not Failing Securely (Failing Open)].

Critical Impact
Any authenticated TDuck user can read submission data from permanently deleted forms, exposing personal information that application owners expected to be inaccessible after form removal.

Affected Products

TDuck survey form 6.0
tduck-api module containing the vulnerable UserFormController
tduck-form module containing UserFormDataServiceImpl and FormAuthUtils

Discovery Timeline

2026-09-25 - CVE-2026-100304 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100304

Vulnerability Analysis

The authorization check in FormAuthUtils.hasPermission validates whether the current user owns the form referenced by a submission. When the form lookup returns no record, the function returns a permissive result instead of denying access. The UserFormController endpoint GET /user/form/data/details relies on this check before returning submission content from UserFormDataServiceImpl. Because the submission row persists after form deletion, the service still resolves the dataId to a stored record. The combination allows an authenticated attacker to iterate or guess known dataId values and retrieve orphaned responses, including personal data captured by the original form.

Root Cause

The root cause is insecure error handling in the ownership check. When the form entity is missing, the control flow returns a value that the caller treats as authorized rather than rejecting the request. This is a classic fail-open pattern tracked under [CWE-636]. Deletion of the parent form does not cascade to the related submission records, leaving orphaned data accessible through a code path that no longer enforces ownership.

Attack Vector

The attack requires network access to the application and a valid, low-privileged authenticated session. An attacker calls GET /user/form/data/details with a dataId referencing a submission whose parent form has been deleted. The authorization helper evaluates the missing form and permits the request. The API returns the submission payload, exposing confidentiality without affecting integrity or availability. Public references include the VulnCheck Advisory on TDuck and a GitHub PoC Repository.

No verified exploit code is reproduced here. Refer to the published advisory and vendor source files such as FormAuthUtils for the authoritative technical details.

Detection Methods for CVE-2026-100304

Indicators of Compromise

Requests to GET /user/form/data/details with dataId values whose associated formId no longer exists in the forms table.
Successful 200 responses from /user/form/data/details for authenticated accounts that did not create the referenced form.
Enumeration patterns against sequential or guessed dataId parameters from a single session or IP.

Detection Strategies

Instrument the UserFormController.details handler to log the resolved formId, requesting user ID, and whether the parent form currently exists.
Correlate submission-access events with recent form deletion events to flag reads of orphaned data.
Alert on authenticated API clients that request submission details across many unrelated dataId values in a short window.

Monitoring Recommendations

Forward TDuck application and reverse-proxy access logs to a centralized analytics pipeline for retention and query.
Build a dashboard that tracks response volume and bytes returned by /user/form/data/details per user account.
Review database audit logs for SELECT activity on the submissions table that is not preceded by a corresponding form ownership resolution.

How to Mitigate CVE-2026-100304

Immediate Actions Required

Restrict access to the /user/form/data/details endpoint at the reverse proxy or WAF until a patched build is deployed.
Audit submission tables for records whose parent form has been deleted and purge or quarantine orphaned entries.
Rotate or revoke low-privileged application accounts that show anomalous access to the details endpoint.

Patch Information

At the time of publication, no vendor-fixed version is listed in the NVD entry. Monitor the TDuck Survey Form project for release notes and apply the vendor update once available. Review the VulnCheck Advisory on TDuck for remediation status updates.

Workarounds

Modify FormAuthUtils.hasPermission so that a missing form returns false, enforcing fail-closed behavior as described in [CWE-636].
Add a database constraint or application-level cascade that deletes submission records when their parent form is removed.
Enforce an authorization filter directly in UserFormDataServiceImpl that joins the submission to the form and the current user before returning data.

bash

# Example reverse-proxy block for the vulnerable endpoint (nginx)
location = /user/form/data/details {
    return 403;
}