---
id: CVE-2026-109164
title: >-
  TDuck survey form through 6.0 contains an insecure direct object reference
  vulnerability that allows authenticated users to delete other users' form
  submissions by supplying arbitrary submission ids
summary: >-
  TDuck survey form through 6.0 contains an insecure direct object reference
  vulnerability that allows authenticated users to delete other users' form
  submissions by supplying arbitrary submission ids. Attackers can place their
  own formKey…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-639
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T13:17:28.460'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109164'
references:
  - url: >-
      https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_form_data_delete_idor.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L182-L187
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java#L149-L154
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-submission-ids-in-post-user-form-data-delete-formkey
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.110Z'
---

## Overview

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.