CVE-2026-111621 TDuckCloud CVE debrief

Who should care

Defenders and administrators of TDuck Survey Form installations, especially those with multiple authenticated users, should assess exposure and prioritize remediation. This includes reviewing system logs for unauthorized access, restricting access to form settings, and ensuring that all users understand the risks associated with this vulnerability. Additionally, security teams should verify that appropriate compensating controls are in place for exposed or

Why it matters

CVE-2026-111621 is a missing authorization vulnerability in TDuck Survey Form through version 5.3. It allows authenticated users to read other owners' raw form settings, potentially exposing sensitive information like form write passwords and owner contact details. Defenders should verify and restrict access to form settings, especially in multi-user environments, and consider updating to a fixed version if available.

• Authenticated users can read sensitive form settings.
• Exposure of form write passwords could compromise form integrity.
• Disclosure of owner notification e-mails and WeChat openIds could lead to further targeted attacks.
• Verification of form setting access controls is necessary to prevent unauthorized reading.

Technical summary

The TDuck Survey Form through version 5.3 contains a missing authorization vulnerability. This vulnerability allows any authenticated user to read other owners' raw form settings via a GET request to /user/form/setting/{key}. The exploit involves supplying the 8-character form key from a public fill link to obtain sensitive information such as the form write password, owner notification e-mail, and WeChat openIds.

Defensive priority

Defenders should prioritize verifying and restricting access to form settings, especially in environments where multiple users have authenticated access.

Recommended defensive actions

• Verify and restrict access to form settings to prevent unauthorized reading.
• Update to a version that fixes the missing authorization vulnerability, if available.
• Monitor for and restrict the use of public fill links that could be used to exploit this vulnerability.
• Consider implementing additional access controls or monitoring for sensitive form settings.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in version 5.3 of the TDuck Survey Form. Details are available in the source references provided. The exploit involves supplying the 8-character form key from a public fill link to obtain sensitive information such as the form write password, owner notification e-mail, and WeChat openIds. Evidence limits are based on public CVE details and may not reflect the full scope of the vulnerability. Defenders should verify and restrict access to form settings, especially in multi-user environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.