TDuck Survey Form EUVD-2026-80813

Requires an authenticated account on the TDuck survey platform (PR:L) - any low-privilege registered user qualifies; no admin role, user interaction, or non-default configuration is needed. Exploitation targets the POST /user/form/data/update endpoint, which lacks ownership validation, and is aided by submission identifiers being allocated in narrow, guessable ranges that let an attacker discover other users' records. Limiting factors: the attacker must first hold valid credentials, and impact is confined to modifying (not reading or deleting/denying) other users' form submission data.

This is a genuine but bounded-priority integrity flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N, base 7.1) is well-calibrated: it correctly captures a network-reachable, low-complexity IDOR that requires only a low-privilege authenticated account (PR:L) - any registered/legitimate user of the survey platform - and delivers high integrity impact (VI:H) with no confidentiality or availability impact. The 'Authentication Bypass' tag overstates the mechanism: this is authorization bypass (CWE-639 IDOR) exercised by an already-authenticated user, not a defeat of authentication. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation or automated weaponization - the reporting is a VulnCheck advisory plus a GitHub issue with direct source-line pointers. The description notes submission identifiers are 'allocated in narrow ranges,' making enumeration/discovery of victim records practical, which raises realistic exploitability above a pure blind-IDOR. Net: prioritize for patching where the product handles personal data (integrity of survey/PII records), but this is not a drop-everything, actively-exploited emergency. No conflicting signals in the data; the main caveat is that all severity/scope claims trace to the vendor advisory and NVD, with no independent confirmation of active exploitation.

An attacker registers or already holds a low-privilege account on a TDuck survey deployment, then enumerates form-submission identifiers (which are allocated in narrow, guessable ranges). They send crafted POST /user/form/data/update requests referencing another user's submission ID; because the endpoint performs no ownership check, the server overwrites the victim's form response containing personal data. No public exploit code was provided, but the source lines and identifier-guessing technique are documented in the VulnCheck advisory and GitHub issue.