CVE-2026-100304 TDuckCloud CVE debrief

Who should care

TDuck survey form 6.0 administrators and users with access to deleted form submissions should verify access controls and review FormAuthUtils.hasPermission implementation. Affected operators, platforms, and security teams should prioritize remediation due to the potential exposure of sensitive information in deleted form submissions. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after

Why it matters

CVE-2026-100304 is a medium-severity information disclosure vulnerability in TDuck survey form 6.0. Authenticated users can access deleted form submissions due to a fail-open permission check. While exploitation requires valid user credentials, sensitive information may still be exposed. Administrators should verify access controls, review FormAuthUtils.hasPermission, and restrict access to the GET /user/form/data/details endpoint.

• Authenticated users may access sensitive information in deleted form submissions
• Personal information in orphaned submissions may be exposed
• Access controls for deleted forms require verification
• Remediation priority is moderate due to limited attack surface

Technical summary

The TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission. When a form does not exist, the permission check fails open, allowing authenticated users to access deleted form submissions by providing a known dataId to the GET /user/form/data/details endpoint. The vulnerability has a medium severity and requires valid user credentials for exploitation. However, sensitive information may still be exposed. Administrators should verify access controls, review FormAuthUtils.hasPermission, and restrict access to the GET /user/form/data/details endpoint.

Defensive priority

Authenticated users may need to verify access controls for deleted form submissions.

Recommended defensive actions

• Verify access controls for deleted form submissions in TDuck survey form 6.0
• Review FormAuthUtils.hasPermission implementation
• Restrict access to GET /user/form/data/details endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references indicate an information disclosure vulnerability in TDuck survey form 6.0. The vulnerability is in FormAuthUtils.hasPermission, which fails open for non-existent forms, allowing access to deleted form submissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.