CVE-2026-100304 in TDuck Survey Form
要約
〜によって MITRE • 2026年09月25日
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.