CVE-2026-111621

Medium

Description

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.

SeverityMedium

CVSS4.3

Exploit probability17. percentile0.3%

ProductTduckcloud Tduck-survey-form

PublishedOct 16, 2026

First seenOct 16, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Patches

github.com/TDuckCloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18

Affected products

Product	Affected versions	Fixed in
TDuckCloud tduck-survey-form	v ≤ 5.3	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.