CVE-2026-100304 in TDuck Survey Form
الملخص
بحسب MITRE • 25/09/2026
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.