CVE-2026-100306 TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
Remote attackers can bypass write password protection and submit survey entries by directly accessing public submission APIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100306?
CVE-2026-100306 is a medium-severity authentication bypass vulnerability in TDuckCloud tduck-survey-form, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links.
Weakness: CWE-602
Which versions are affected by CVE-2026-100306?
How do I fix CVE-2026-100306?
No fix has been published for CVE-2026-100306 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-100306 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100306 exists.
Sources
Also known as GHSA-5966-7cgr-qvf4.