CVE-2026-100303 TDuckCloud CVE debrief

Who should care

Defenders responsible for TDuck survey form installations, especially those where multiple users have access to the form management interface, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-100303 is a MEDIUM-severity vulnerability in TDuck survey form that allows authenticated non-admin users to modify global form themes and categories. Defenders should verify exposure, especially in multi-user environments, and prioritize remediation to prevent unauthorized changes.

• Potential unauthorized modifications to form themes or categories by authenticated non-admin users.
• Impact on form integrity or user trust if themes or categories are modified without proper authorization.
• Need for verification of current version and exposure to this vulnerability.
• Priority for remediation or compensating controls to prevent unauthorized access to FormThemeController write endpoints.

Technical summary

The TDuck survey form through version 6.0 has a vulnerability where authenticated non-admin users can add, modify, or delete global form themes and categories. This is due to missing authorization checks on FormThemeController write endpoints. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Affected product deployments should be verified, and defenders should prioritize remediation, especially in systems where unauthorized theme or category modifications could impact form integrity or user trust.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where unauthorized theme or category modifications could impact form integrity or user trust.

Recommended defensive actions

• Verify the version of TDuck survey form in use and check if it is vulnerable (version 6.0 or earlier).
• Restrict access to FormThemeController write endpoints to prevent unauthorized modifications.
• Monitor for any unauthorized changes to form themes or categories.
• Consider upgrading to a version of TDuck survey form that includes authorization checks for FormThemeController write endpoints.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. However, specific details about affected versions, exploitation, or remediation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.