---
id: CVE-2026-92602
title: >-
  TDuck survey form through version 5.3 fails to validate webhook URLs or verify
  form ownership in the WebhookConfigController
summary: >-
  TDuck survey form through version 5.3 fails to validate webhook URLs or verify
  form ownership in the WebhookConfigController. Authenticated attackers can
  attach webhooks to other users' forms and exfiltrate submissions to arbitrary
  exter…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-918
vendor: TDuckCloud
product: tduck-survey-form
affected:
  - tduck-survey-form <= 5.3
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92602'
references:
  - url: 'https://github.com/TDuckCloud/tduck-survey-form'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100
    label: disclosure@vulncheck.com
  - url: 'https://github.com/TDuckCloud/tduck-survey-form/issues/40'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url
    label: disclosure@vulncheck.com
  - url: 'https://github.com/TDuckCloud/tduck-survey-form/issues/40'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00401
epssPercentile: 0.31554
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T17:43:30.320835Z'
ingestedAt: '2026-09-16T16:59:56.621Z'
---

## Overview

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.