TDuck Survey Form EUVD-2026-97370

Requires a valid authenticated account on the TDuck platform (PR:L) and network reachability to the POST user-form-data-delete / form-data endpoint; the specific prerequisite is that the attacker supplies their own formKey in the request path together with arbitrary, sequentially iterable submission IDs in the request body, which the server fails to authorize against the requester. LIMITING FACTORS: exploitation is gated by needing any authenticated session (so instances restricted to trusted internal users are far lower risk), and impact is confined to permanent deletion of other users' submissions (data loss) - there is no code execution, data exfiltration, or privilege escalation. No special non-default configuration is required beyond running an affected version (through 6.0) with registrable or multi-user access.

This is a credible but bounded data-integrity/availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-complexity, network-reachable attack requiring only a low-privileged authenticated account, with high availability impact to victim data (VA:H), low integrity impact (VI:L), and no confidentiality impact (VC:N) - consistent with an IDOR that permanently destroys other users' submissions but does not read or corrupt them in place. Publicly available POC exploit code exists (a Python script in the referenced GitHub repo), which raises practical exploitability, but this CVE is NOT in CISA KEV and shows no public evidence of active exploitation, so POC availability must not be conflated with in-the-wild use. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be assessed here. SSVC inputs are not fully supplied, but the design implies the flaw is highly automatable (sequential ID iteration) with a technical impact limited to data destruction, not code execution or privilege escalation. The input Tag 'Authentication Bypass' conflicts with both the description and the PR:L vector: exploitation REQUIRES a valid authenticated session, and the VulnCheck advisory frames this as an authorization bypass (IDOR), not authentication bypass - verify the tag classification. Net: a genuine priority for anyone running internet-exposed TDuck instances with untrusted registered users, but its low real-world footprint and lack of KEV/active-exploitation signals keep it below critical-triage urgency.

An attacker registers or obtains any low-privileged account on an internet-exposed TDuck survey platform, then sends POST requests to the form-data-delete endpoint placing their own formKey in the path while iterating sequential, attacker-controlled submission IDs in the request body. Because the server does not verify ownership of the submission IDs, it permanently deletes other users' form responses platform-wide. A public Python POC (poc_form_data_delete_idor.py) automates this request pattern.