EUVD-2026-87292Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint reachable by any authenticated user (PR:L), low complexity to call with a known dataId; confidentiality-only PII exposure (C:H), no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
AnalysisAI
TDuck Survey Form 6.0 fails open in its form-ownership authorization check, letting an authenticated user read submission records that belong to forms which have been permanently deleted. An attacker who knows or can guess a dataId can call GET /user/form/data/details and retrieve the orphaned submission row, including personal information, because FormAuthUtils.hasPermission returns a permissive result when the parent form no longer exists; for live forms the ownership check behaves normally. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated TDuck account (PR:L) able to call the GET /user/form/data/details endpoint, plus knowledge of a valid dataId (which may be enumerable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, authenticated information-disclosure flaw whose real-world risk sits below its 6.0 CVSS 4.0 score once gating factors are weighed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at the time of analysis - neither a fixed version number nor a patch advisory is present in the available data, only the vulnerable source commit and a third-party advisory, so teams cannot simply 'upgrade to version X'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tduck Survey Form
View allMissing server-side enforcement of the write/submission password in TDuck survey form through 6.0 allows remote unauthen
Authenticated non-admin users can add, modify, or delete global form themes and theme categories in TDuck Survey Form th
Authenticated users who know a form's key can flood TDuck Survey Form through 6.0 with unlimited submissions via POST /u
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-p
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submiss
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today