---
id: CVE-2026-111621
title: >-
  TDuck Survey Form through 5.3 contains a missing authorization vulnerability
  that allows any authenticated user to read other owners' raw form settings via
  GET /user/form/setting/{key}
summary: >-
  TDuck Survey Form through 5.3 contains a missing authorization vulnerability
  that allows any authenticated user to read other owners' raw form settings via
  GET /user/form/setting/{key}. Attackers can supply the 8-character form key
  from …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: TDuckCloud
product: tduck-survey-form
affected:
  - tduck-survey-form <= 5.3
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T22:17:21.067'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111621'
references:
  - url: 'https://github.com/TDuckCloud/tduck-survey-form'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/blob/5.3/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L66-L75
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/TDuckCloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/tduck-survey-form-setting-cross-user-disclosure
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-missing-authorization-via-user-form-setting-key
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00251
epssPercentile: 0.16367
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:33:57.790840Z'
ingestedAt: '2026-10-16T18:43:08.692Z'
---

## Overview

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.