EUVD-2026-80860
GHSA-j7wg-fgxp-4h6h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authenticated network attacker (PR:L, AV:N, AC:L) exfiltrates other users' submissions (C:H) and injects webhook config (I:L); no availability impact and no confirmed scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
AnalysisAI
Authenticated users of TDuck Survey Form through version 5.3 can hijack forms they do not own and redirect their submissions to arbitrary destinations, because WebhookConfigController enforces neither a form-ownership check nor any validation of the webhook URL. The result is a chained broken-access-control/IDOR plus server-side request forgery issue: a low-privilege account can point a victim's webhook at an external collector to exfiltrate form data, or at internal-only addresses to make the TDuck server issue requests on the attacker's behalf, producing high confidentiality impact with only limited integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account on the TDuck survey-form application (PR:L) but NO ownership of the target form: the WebhookConfigController performs neither a form-ownership check nor webhook-URL validation, so any authenticated user can attach a webhook to another user's form. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue best understood as a dual flaw: a broken-access-control / IDOR problem (WebhookConfigController does not verify form ownership) chained with an SSRF (webhook URLs are never validated). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released fix version is identified in the available data; the only vendor-side artifacts provided are the project repository and issue #40 (https://github.com/TDuckCloud/tduck-survey-form/issues/40), so tracking that issue and the VulnCheck advisory (https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url) is the first step before applying an upstream fix once it is tagged. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory every TDuck Survey Form instance and confirm which run version 5.3 or earlier; where webhooks are not essential, disable the feature entirely, and where they are required, restrict webhook configuration (WebhookConfigController) to a small set of trusted administrators; audit all existing webhook URLs and remove or remediate any pointing to external collectors or internal-only addresses; and preserve form, webhook, and server-side request logs for investigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tduck Survey Form
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today