CVE-2026-109167
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated attackers can overwrite and deface other users' survey form themes, stripping existing colors and assets. They only need a standard account and network access to submit theme save requests.
Root cause
The saveFormTheme endpoint fails to verify ownership of the submitted theme ID, allowing sequential IDs to be modified by unauthorized users.
Affected systems
TDuck survey form through 6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
No fixed version or patch is listed yet; restrict untrusted user account registration or block requests to the /user/form/theme/save endpoint at the reverse proxy if themes are not actively needed.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.
References
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_user_form_theme_save_id_confusion.py
- https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java#L393-L405
- https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-theme-id-in-post-user-form-theme-save