CVE-2026-109167: TDuck Survey Form Privilege Escalation

CVE-2026-109167 Overview

CVE-2026-109167 is an insecure direct object reference (IDOR) vulnerability in TDuck survey form through version 6.0. The flaw resides in the saveFormTheme handler within UserFormController.java, which fails to verify that the submitted theme identifier belongs to the authenticated user's form. Any authenticated user can overwrite other users' form themes by submitting another form's sequential theme id together with their own formKey. The attack replaces the victim theme's colours and image URLs and removes the victim's association with that theme. The issue is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can tamper with and effectively hijack theme records belonging to other TDuck users, breaking tenant isolation on form branding assets.

Affected Products

TDuck survey form through 6.0
tduck-api component — UserFormController.saveFormTheme handler
Deployments exposing the form theme save endpoint to authenticated users

Discovery Timeline

2026-10-12 - CVE-2026-109167 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109167

Vulnerability Analysis

TDuck stores form themes as sequential, numeric records that are referenced by id when a form is customized. The saveFormTheme handler accepts a theme id and a formKey from the request body and persists the update without validating that the theme id is actually owned by the form identified by formKey. Because the theme id is a predictable sequential integer, an attacker can enumerate ids belonging to other tenants.

An authenticated user whose own form has no theme assigned can submit another form's theme id while supplying their own formKey. The backend overwrites the targeted theme record with attacker-controlled colours and image URLs. The write also reassigns the theme association, removing the victim's theme from their form.

Impact is limited to integrity of theme data. The vulnerability does not grant code execution, credential disclosure, or availability loss on the host. However, replacing image URLs with attacker-controlled links creates a vector for content spoofing and phishing against survey respondents.

Root Cause

The handler relies on client-supplied identifiers without a server-side ownership check. The code path at UserFormController.java lines 393–405 updates the theme row keyed on the request-supplied id, instead of resolving the theme through the authenticated user's form association. See the TDuck UserFormController source for the vulnerable handler.

Attack Vector

Exploitation requires only low-privileged authenticated access over the network. The attacker iterates sequential theme ids and issues POST requests to the theme save endpoint, pairing each id with their own formKey. A public proof-of-concept script is available in the cve-request-poc repository, and additional detail is provided in the VulnCheck advisory.

// No synthetic exploit code is reproduced here.
// Refer to the linked VulnCheck advisory and PoC script above
// for the exact request structure targeting saveFormTheme.

Detection Methods for CVE-2026-109167

Indicators of Compromise

POST requests to the TDuck form theme save endpoint where the request body id field does not correspond to a theme owned by the authenticated user's formKey.
Sudden changes to theme colour hex values or background image URLs on forms that were not edited by their owner.
Theme image URLs pointing to external domains not previously used by the tenant.

Detection Strategies

Review application logs for sequential enumeration patterns against the theme save endpoint from a single authenticated session.
Correlate formKey values and theme id values in audit logs to flag mismatched ownership on write operations.
Hash and baseline theme records; alert on unexpected mutations outside normal user activity windows.

Monitoring Recommendations

Enable database-level audit logging on the form theme table to capture update operations with the acting user id.
Forward web server and application logs to a centralized analytics platform for queryable retention.
Alert on authenticated users touching more theme ids per hour than a defined baseline, which indicates enumeration.

How to Mitigate CVE-2026-109167

Immediate Actions Required

Restrict access to the TDuck administrative and form editing endpoints to trusted authenticated users only, pending a vendor fix.
Audit the form_theme table for unauthorized modifications and restore legitimate theme data from backups where tampering is confirmed.
Rotate or re-scope any shared service accounts that have access to the TDuck API to reduce blast radius during triage.

Patch Information

No vendor patch is referenced in the published CVE record at the time of writing. Monitor the TDuck survey form repository and the VulnCheck advisory for release notes addressing the saveFormTheme handler.

Workarounds

Add a server-side ownership check that resolves the theme row by joining on the authenticated user's formKey before applying updates.
Place a reverse proxy or web application firewall rule in front of the theme save endpoint to block requests where the id field is not associated with the caller's forms.
Temporarily disable the form theme customization feature if the deployment is multi-tenant and cannot enforce ownership validation.

bash

# Example WAF-style guard: reject POSTs to the theme save endpoint
# that lack an authenticated session or carry unexpected id ranges.
# Replace path and header names with values matching your deployment.
location /api/user/form/theme/save {
    if ($http_authorization = "") { return 401; }
    limit_req zone=theme_save burst=5 nodelay;
    proxy_pass http://tduck_backend;
}