EUVD-2026-97373
GHSA-w8cw-4mm2-mrw7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitEnumerate victim's sequential theme id
-
ExecutionPOST saveFormTheme with victim theme id and attacker formKey
-
ImpactOverwrite colours/image URLs and remove victim theme
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated TDuck account (PR:L) and that the attacker's OWN form currently has no theme assigned - the saveFormTheme handler path is reached in that state and fails to verify theme ownership. Theme ids are sequential/predictable, enabling the attacker to enumerate and target a victim form's theme id while supplying their own formKey. Limiting factors: exploitation is impossible without authentication, impact is restricted to tampering with theme data (colours and image URLs) of other users' forms, and there is no confidentiality or availability consequence; this is multi-tenant tampering, not account takeover. |
| Impact | This is a genuinely low-to-moderate real-world risk despite a public PoC. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 (Medium) and is internally consistent with the description: it is network-reachable with low complexity but requires an authenticated low-privilege account (PR:L) and no user interaction. Impact is confined to integrity of another user's form theme (VI:L) - overwriting colours and image URLs and removing the victim's theme - with no confidentiality (VC:N) and no availability (VA:N) impact, so this is effectively limited tampering/defacement of a cosmetic resource, not data theft or RCE. Exploitation signal: publicly available exploit code exists (github-poc), but the issue is NOT in CISA KEV, so there is no evidence of active exploitation; PoC availability and active exploitation are distinct and should not be conflated here. EPSS score was not provided in the input and cannot be cited. The input Tag 'Authentication Bypass' conflicts with the actual nature of the flaw: CWE-639 and the VulnCheck advisory title both describe an authorization bypass / IDOR against an already-authenticated user - verify tagging. Net: real but low-priority; prioritize patching for multi-tenant deployments but it does not warrant emergency response. |
| Exploit ScenarioDerived | An authenticated low-privilege TDuck user whose own form has no theme assigned calls the saveFormTheme handler, supplying a victim form's sequential (predictable) theme id together with their own formKey. The server fails to verify theme ownership, so the attacker overwrites the victim's theme - replacing colours and image URLs and effectively removing the original theme. A public PoC (poc_user_form_theme_save_id_confusion.py) demonstrates this id-confusion overwrite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Authenticated users of TDuck survey form (through version 6.0) can overwrite other tenants' form themes - colours and image URLs - by submitting a victim's predictable, sequential theme id together with their own formKey to the saveFormTheme handler. The flaw is an insecure direct object reference (CWE-639) with no confidentiality or availability impact; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, so exploitation requires a valid TDuck account and a form that currently has no theme assigned, which is the state in which the handler is reached and the ownership check is skipped. Publicly available exploit code exists (a Python PoC published by VulnCheck's reporter), but there is no confirmed active exploitation (no CISA KEV listing), making this a low-to-moderate, multi-tenant data-tampering risk rather than an account-takeover or data-disclosure issue.
RemediationAI
No vendor-released patch or fixed version was identified in the available intelligence at the time of analysis; the referenced GitHub link is the vulnerable source (UserFormController.saveFormTheme, lines 393-405), not a fix commit, so the appropriate action is to open a support request with TDuckCloud and track the VulnCheck advisory at https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-theme-id-in-post-user-form-theme-save for the patched release. Until a fix is available, the most effective compensating control is to enforce server-side ownership validation: derive the theme-to-form association from the authenticated principal instead of the request-supplied theme id, and reject any request where the theme's owning form does not match the caller's formKey - this is the corrective change that eliminates the IDOR entirely, with no functional trade-off beyond the code change. Where the code cannot be modified promptly, block or restrict access to the theme-save endpoint (POST to /user/form/theme/save on tduck-api) for non-administrative roles at the reverse proxy or WAF, or disable end-user theme customization platform-wide; this removes the attack path but degrades the self-service theming feature for all tenants. A lower-impact interim option is to convert theme identifiers from sequential integers to unguessable UUIDs so enumeration is no longer viable, though this treats the symptom rather than the missing authorization check. Because exploitation requires an authenticated account and works by enumerating adjacent ids, monitor API logs for a single account submitting saveFormTheme requests with quickly incrementing theme ids or with form keys that do not correspond to the caller's own forms, and rotate or audit tenant theme configuration for unexpected colour or image-URL changes as detective controls. Note that public exploit code exists, but there is no confirmation of active exploitation, so remediation can proceed on a normal risk-based schedule rather than as an emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TDuck is a Java/Spring Boot multi-tenant survey and form platform, and the affected component is the user-facing form API (tduck-api), specifically the saveFormTheme handler in UserFormController (referenced at lines 393-405 of the upstream repository). The handler accepts a user-supplied formKey identifying the caller's own form along with a theme id, and persists theme settings (colours and image URLs) against the referenced theme record without verifying that the theme belongs to the authenticated principal's form. This is the classic CWE-639 authorization-through-user-controlled-key pattern: the object identifier is trusted from the request rather than derived from the session. The impact is amplified because theme ids are sequential and therefore trivially enumerable, so a low-privileged authenticated user can guess adjacent ids and target another tenant's theme. A notable precondition observed in the assessment is that the vulnerable code path is reached specifically when the attacker's own form has no theme assigned, which is what allows the attacker-controlled id to be substituted. There is no server-side ownership binding between the authenticated user's form and the theme record being mutated, and no CPE entries were supplied, so exact product/version fingerprinting must rely on the vendor's own release line (TDuck survey form through 6.0).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable with low complexity but requires an authenticated account (PR:L); only low integrity impact from overwriting another user's theme data, with no confidentiality or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB