---
id: CVE-2026-92567
title: >-
  TDuck survey form through version 5.0 contains an authorization bypass
  vulnerability in the POST /user/form/data/update endpoint that allows
  authenticated users to overwrite other users' form submission data
summary: >-
  TDuck survey form through version 5.0 contains an authorization bypass
  vulnerability in the POST /user/form/data/update endpoint that allows
  authenticated users to overwrite other users' form submission data. Attackers
  can discover submi…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-639
vendor: TDuckCloud
product: tduck-survey-form
affected:
  - tduck-survey-form <= 5.0
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T20:18:56.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92567'
references:
  - url: 'https://github.com/TDuckCloud/tduck-survey-form'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L198-L207
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java#L158-L167
    label: disclosure@vulncheck.com
  - url: 'https://github.com/TDuckCloud/tduck-survey-form/issues/39'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/tduck-survey-form-through-5.0-unauthorized-data-modification
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T19:16:41.727275Z'
ingestedAt: '2026-09-16T14:57:28.039Z'
epss: 0.00336
epssPercentile: 0.27136
---

## Overview

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.