{"id":"CVE-2026-111621","kind":"vulnerability","aliases":["CVE-2026-111621"],"related":[],"title":"TDuck Survey Form: any logged-in user can read other owners' form settings","description":"TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.","summary":"TDuck Survey Form through 5.3 lets any authenticated user call GET /user/form/setting/{key} and read another owner's raw form settings without an ownership check. An attacker who has the 8-character form key from a public fill link can obtain the form write password, the owner's notification e-mail and WeChat openIds.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","survey-form","tduck"],"not_affected_if":["no-user-registration","version-above-5.3"],"how_to_check":"- Check whether the TDuck Survey Form deployment is version 5.3 or earlier; the sources do not name a fixed version, so confirm against the project's release notes.\n- Test that `GET /user/form/setting/{key}` with a non-owner account returns another owner's form settings, which indicates the flaw is present.","fix":null,"status":"open","published_at":"2026-10-16T18:17:41+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:15+00:00","updated_at":"2026-10-25T04:27:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TDuck Survey Form: any logged-in user can read other owners' form settings","impact":"medium","summary":"TDuck Survey Form through 5.3 lets any authenticated user call GET /user/form/setting/{key} and read another owner's raw form settings without an ownership check. An attacker who has the 8-character form key from a public fill link can obtain the form write password, the owner's notification e-mail and WeChat openIds.","category":"package","nicknames":[],"who_cares":["self-hosted","survey-form","tduck"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads form write passwords and owner contact details","analyst_note":"Find the patched version and fix commit for TDuck Survey Form after 5.3 on the project repository or NVD references.","how_to_check":"- Check whether the TDuck Survey Form deployment is version 5.3 or earlier; the sources do not name a fixed version, so confirm against the project's release notes.\n- Test that `GET /user/form/setting/{key}` with a non-owner account returns another owner's form settings, which indicates the flaw is present.","needs_analyst":true,"not_affected_if":["version-above-5.3","no-user-registration"],"who_is_affected":"Any deployment of TDuck Survey Form through 5.3 that allows ordinary user accounts to log in is exposed, because the flaw is a missing authorization check on a logged-in endpoint. Installations where only the form owner can authenticate, or that do not run this version, can skip it. The sources do not say whether the flaw is reachable without an account.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":3329,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111621':17A,20A '-2026':16A,19A '/user/form/setting':40B,108C '5.3':33B,88C '8':59B,114C 'allow':95C 'anoth':44B 'attack':55B,110C 'authent':36B,97C 'author':92C 'call':38B 'charact':60B,115C 'check':53B 'contain':89C 'cve':15A,18A 'e':79B,132C 'e-mail':78B,131C 'fill':66B,121C 'form':3A,13A,27B,31B,48B,61B,71B,86C,104C,116C,126C 'get':39B,107C 'host':24B 'key':41B,62B,109C,117C 'let':34B 'link':67B,122C 'log':6A 'logged-in':5A 'mail':80B,133C 'miss':91C 'notif':77B,130C 'obtain':69B,124C 'openid':83B,136C 'owner':12A,45B,75B,102C,129C 'ownership':52B 'packag':21B 'password':73B,128C 'public':65B,120C 'raw':47B,103C 'read':10A,43B,100C 'self':23B 'self-host':22B 'set':14A,49B,105C 'suppli':112C 'survey':2A,26B,30B,85C 'survey-form':25B 'tduck':1A,28B,29B,84C 'user':8A,37B,98C 'via':106C 'vulner':93C 'wechat':82B,135C 'without':50B 'write':72B,127C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of TDuck Survey Form through 5.3 that allows ordinary user accounts to log in is exposed, because the flaw is a missing authorization check on a logged-in endpoint. Installations where only the form owner can authenticate, or that do not run this version, can skip it. The sources do not say whether the flaw is reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111621","severity":null,"published_at":"2026-10-16T18:17:41+00:00","modified_at":"2026-10-16T22:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}