CVE-2026-92567: TDuck Survey Form Auth Bypass Vulnerability

CVE-2026-92567 Overview

CVE-2026-92567 is an authorization bypass vulnerability in TDuck survey form through version 5.0. The flaw resides in the POST /user/form/data/update endpoint, which fails to validate that the authenticated user owns the form submission being modified. Any authenticated user can overwrite arbitrary form responses belonging to other users. Because submission identifiers are allocated in narrow, predictable ranges, attackers can enumerate valid IDs and tamper with personal data captured by any published form. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated attackers can modify arbitrary form submission records, including personal data collected from other respondents, without triggering any ownership check.

Affected Products

• TDuck survey form through version 5.0
• tduck-api component (UserFormResultController)
• tduck-form component (UserFormDataServiceImpl)

Discovery Timeline

• 2026-09-16 - CVE-2026-92567 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92567

Vulnerability Analysis

TDuck is an open-source survey and form building platform. The POST /user/form/data/update endpoint accepts a submission identifier and a payload of updated field values from an authenticated user. The controller path handling the request forwards the update to the service layer without confirming that the current session user is the original submitter or owner of the target record. As a result, a low-privilege authenticated account can send crafted update requests referencing submission IDs belonging to other users and overwrite their stored responses. Referenced source in UserFormResultController.java and UserFormDataServiceImpl.java shows the update path invoking a data-layer write keyed on the client-supplied identifier alone.

Root Cause

The root cause is a missing authorization check between the authentication layer and the data-update logic. The application trusts the submission identifier supplied in the request body as sufficient to authorize the write. No verification links the submission record to the authenticated principal, meeting the definition of an Insecure Direct Object Reference under CWE-639. The problem is compounded by sequential, narrow-range allocation of submission identifiers, which removes any practical entropy an attacker would need to guess to reach valid records.

Attack Vector

Exploitation requires network access to the TDuck web application and any valid authenticated account, including a self-registered one on instances that permit open registration. An attacker enumerates submission identifiers by incrementing numeric values, then issues POST /user/form/data/update requests carrying arbitrary field data for each targeted ID. The server applies the update, replacing personal data collected from legitimate respondents. No user interaction is required from the victim, and no elevated privileges are needed. Full technical background is available in the VulnCheck Security Advisory and GitHub Issue #39.

No public proof-of-concept exploit code has been released. See the referenced source files for the vulnerable code paths: UserFormResultController and UserFormDataServiceImpl.

Detection Methods for CVE-2026-92567

Indicators of Compromise

• Sequential POST /user/form/data/update requests from a single authenticated session iterating through submission identifiers.
• Submission records with updated timestamps or field values that do not correspond to the original respondent's session or IP address.
• Application logs showing update operations where the acting user ID differs from the record's original submitter ID.

Detection Strategies

• Instrument the update endpoint to log the acting user, target submission owner, and record ID, then alert when they diverge.
• Baseline normal update rates per user account and flag accounts issuing bursts of update calls across many distinct submission IDs.
• Correlate authentication events with subsequent update activity to identify newly registered accounts immediately probing the update endpoint.

Monitoring Recommendations

• Enable verbose HTTP access logging on the tduck-api service and forward it to a centralized log platform.
• Monitor database write patterns on the form submission table for unusual update-to-insert ratios.
• Review web application firewall (WAF) telemetry for repeated requests to /user/form/data/update with varying numeric identifiers.

How to Mitigate CVE-2026-92567

Immediate Actions Required

• Restrict access to the TDuck instance to trusted networks or authenticated internal users until an official fix is applied.
• Disable open self-registration to reduce the pool of accounts able to reach the vulnerable endpoint.
• Audit existing submission data for unauthorized modifications and preserve backups for forensic comparison.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Monitor the TDuck project repository and GitHub Issue #39 for a fix. A proper remediation must add an ownership check in UserFormDataServiceImpl that verifies the authenticated user is the original submitter, or enforce role-based authorization for cross-user updates.

Workarounds

• Deploy a reverse proxy or WAF rule blocking POST /user/form/data/update for non-administrative users.
• Rotate submission identifiers to use non-sequential, high-entropy values (for example, UUIDs) to defeat enumeration.
• Place the TDuck application behind an authenticating proxy that enforces per-form access control lists.

# Example NGINX rule to block the vulnerable endpoint until patched
location = /user/form/data/update {
    return 403;
}