---
id: CVE-2026-111621
title: >-
  TDuck Survey Form through 5.3 Missing Authorization via
  /user/form/setting/{key}
summary: >-
  TDuck Survey Form through 5.3 contains a missing authorization vulnerability
  that allows any authenticated user to read other owners' raw form settings via
  GET /user/form/setting/{key}. Attackers can supply the 8-character form key
  from …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: TDuckCloud
product: tduck-survey-form
affected:
  - tduck-survey-form <= 5.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:33:57.790840Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T21:19:28.058Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111621'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/tduck-survey-form-setting-cross-user-disclosure
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/5.3/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L66-L75
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18
  - url: 'https://github.com/TDuckCloud/tduck-survey-form'
  - url: >-
      https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-missing-authorization-via-user-form-setting-key
    label: >-
      VulnCheck Advisory: TDuck Survey Form through 5.3 Missing Authorization
      via /user/form/setting/{key}
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.692Z'
---

## Overview

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.

## Affected

- `tduck-survey-form <= 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.