CVE-2026-100304 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
Authenticated users can read deleted form submissions containing personal information due to a fail-open permission check.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100304?
CVE-2026-100304 is a medium-severity vulnerability in TDuckCloud tduck-survey-form, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted.
Weakness: CWE-636
Which versions are affected by CVE-2026-100304?
How do I fix CVE-2026-100304?
No fix has been published for CVE-2026-100304 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100304 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100304 exists.
Sources
Also known as GHSA-3hhg-8chj-hh93.