TDuck Survey Form CVE-2026-111621

Exploitation requires (1) a valid authenticated account on the target TDuck Survey Form instance - any low-privileged user suffices (CVSS PR:L), so risk is elevated where self-service user registration is enabled - and (2) knowledge of the 8-character form key, which is not a secret because it is embedded in the public survey fill link shared with respondents. No user interaction from the victim and no special server configuration are needed; the flaw stems from the /user/form/setting/{key} endpoint omitting an owner/authorization check. Limiting factors: the attacker must authenticate first, and disclosure is confined to per-form settings (write password, owner notification e-mail, WeChat openIds) rather than whole-system data.

This is a genuine but modest-severity authorization flaw (CWE-639, IDOR), not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) is internally consistent with the description: network-reachable, low-complexity, requires an authenticated low-privileged account, and yields limited confidentiality impact only. No EPSS score, no CISA KEV listing, and no POC/exploit-code flag were supplied in the input, so there is no public exploit identified at time of analysis - the signals are coherent rather than conflicting. The risk is bounded by the PR:L authentication requirement and by the fact that only per-form settings (write password, owner notification e-mail, WeChat openIds) are disclosed, not full application compromise or integrity/availability impact. Note: the leaked 'form write password' could enable downstream unauthorized form edits, so confidentiality impact is arguably more consequential than a raw C:L suggests, but this remains a targeted, authenticated data-disclosure issue rather than a mass-exploitable RCE. Treat as a real fix-worthy bug of moderate urgency, especially for multi-tenant TDuck deployments with open user registration.

An attacker registers or already holds any low-privileged account on a TDuck Survey Form instance, then copies the 8-character form key visible in a victim's public survey fill link. They issue an authenticated GET /user/form/setting/{key} request and receive the target form's raw settings, exposing the form write password, the owner's notification e-mail, and associated WeChat openIds. No public exploit code was identified in the provided data, but the technique is trivial to reproduce given the low attack complexity.