What is CVE-2026-92567?

CVE-2026-92567 is a medium-severity vulnerability in Tduckcloud Tduck-Survey-Form, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-16.

How severe is CVE-2026-92567?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Tduckcloud Tduck-Survey-Form

CVE-2026-92567

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Tduckcloud Tduck-survey-form

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-92567?: CVE-2026-92567 is a medium-severity vulnerability in Tduckcloud Tduck-Survey-Form, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-16.
How severe is CVE-2026-92567?: Medium severity. CVSS v3 base score is 6.5 out of 10.