GHSA-47j6-wrmm-xx5gMediumCVSS 5.4
TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints...
🔗 CVE IDs covered (1)
📋 Description
TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-100303
- https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_theme_write.py
- https://github.com/TDuckCloud/tduck-survey-form
- https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormThemeController.java#L61-L120
- https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-missing-authorization-in-form-theme-management-endpoints
- https://github.com/advisories/GHSA-47j6-wrmm-xx5g