Live › vulnerability › CVE-2026-111621
Go to dashboardTDuck Survey Form through 5.3 lets any authenticated user call GET /user/form/setting/{key} and read another owner's raw form settings without an ownership check. An attacker who has the 8-character form key from a public fill link can obtain the form write password, the owner's notification e-mail and WeChat openIds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of TDuck Survey Form through 5.3 that allows ordinary user accounts to log in is exposed, because the flaw is a missing authorization check on a logged-in endpoint. Installations where only the form owner can authenticate, or that do not run this version, can skip it. The sources do not say whether the flaw is reachable without an account.
No product ranges from the sources yet.
GET /user/form/setting/{key} with a non-owner account returns another owner's form settings, which indicates the flaw is present.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
This page as .md · .json · in your agent: get_signal("CVE-2026-111621")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.