CVE-2026-100305 TDuckCloud CVE debrief

Who should care

Defenders responsible for TDuck survey form installations should assess exposure and prioritize remediation based on the CVSS score of 5.3. This includes reviewing the vulnerability's impact on data integrity and decision-making processes. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential risks and take necessary actions.

Why it matters

CVE-2026-100305 allows authenticated attackers to bypass form fill-in restrictions in TDuck survey form versions up to 6.0, potentially impacting data integrity and decision-making processes.

• Falsified survey results could impact decision-making processes
• Bypassed restrictions could lead to data integrity issues
• Unauthenticated users could submit arbitrary form data
• Remediation priority is medium due to the CVSS score of 5.3

Technical summary

The TDuck survey form through version 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. This allows authenticated attackers who know a form's key to submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions to falsify collected results. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Defenders should prioritize verifying the vulnerability in TDuck survey form versions up to 6.0 and assessing exposure.

Defensive priority

Defenders should prioritize verifying the vulnerability in TDuck survey form versions up to 6.0 and assessing exposure.

Recommended defensive actions

• Verify the vulnerability in TDuck survey form versions up to 6.0
• Assess exposure and prioritize remediation
• Monitor for potential abuse of the authenticated submission endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source references provide details on the vulnerability in TDuck survey form versions up to 6.0. The vulnerability allows authenticated attackers who know a form's key to submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions. Evidence is limited to CVE and NVD details. Defenders should verify the vulnerability in TDuck survey form versions up to 6.0 and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.