CVE-2026-100305: Tduckcloud Tduck-Survey-Form

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions to falsify collected results.

Affected products

• Tduckcloud Tduck-Survey-Form: up to and including 6.0

Published 2026-09-25. Last modified 2026-09-28.