TDuck Survey Form EUVD-2026-97371

Requires a valid authenticated account on the target TDuck instance (any registered low-privileged user suffices, per PR:L) and knowledge of the victim's formKey, which is exposed on the form's public fill page and is therefore readily obtainable. The attacker must craft the batch-create array so the first element points to a form they legitimately own (satisfying the flawed server-side ownership check) while subsequent elements carry the victim's formKey. Limiting factors: exploitation is confined to integrity impact (injecting/adding fields to another user's form) with no confidentiality or availability impact, and it cannot be performed fully unauthenticated - a registration-open or multi-tenant deployment materially increases exposure.

This is a medium-severity broken access control / IDOR issue (CWE-639) whose signals are internally consistent and point to a real-but-limited risk rather than an urgent priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation that requires an authenticated low-privileged account (PR:L) and no user interaction, with impact scoped to integrity only (VI:L; VC:N, VA:N) - matching the description, which describes injecting attacker-chosen fields onto a victim's form rather than data theft or code execution. Publicly available POC code raises operational risk (the exploit path is documented and reproducible), but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated here. The main mitigating factors are the authentication requirement and the integrity-only, low-impact nature of the bug; the aggravating factor is that any registered user can target any other user's public form. Net: a legitimate low-to-medium priority for TDuck operators, not a drop-everything critical.

An attacker registers or uses an existing low-privileged account on a TDuck survey instance, obtains the public formKey of a victim's survey, and sends a crafted POST /user/form/item/batch/create request containing a field array whose first element references the attacker's own form and later elements reference the victim's formKey. The server authorizes the request based only on the first element, so the attacker's chosen fields are injected onto the victim's public fill page. Publicly available POC code (github-poc) demonstrates this cross-form injection, lowering the barrier to exploitation.