TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.
{
"cna_assigner": "VulnCheck",
"cwe_ids": [
"CWE-639"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111621.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "5.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "984efd69f51778e3d1a9ea0feb0f7c9aed266c18"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111621.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "1379599561389503384454524564678227034",
"length": 225
},
"id": "CVE-2026-111621-172885d6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "batchCreateFormItem"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "58728522169065426406257718377540647448",
"length": 116
},
"id": "CVE-2026-111621-1e581e7f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "queryUserFormFields"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265244318536226339159707887267683410185",
"167156236538422751092220032681735849962",
"166360963634660081679343117978614091406",
"327109217212637911568179901973762788965",
"64145582720435758215080140101698494409",
"198406352332165058109975714532187319490",
"182294923730163039062731146157670044757",
"151376927146945788008942019674103809641",
"209017288450264055638272744538488369809",
"323764583651997195649587748271813799427",
"258349174189355243478977693644236916111",
"120942732361452467479684925358931777843",
"233280955741370187754880915344199647330",
"319550607601779556184065392232235516563",
"154323239163563661213405239462627073208",
"235891048694368774295934157275334379550"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-271d535d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "1133215329101806224896849748604487910",
"length": 681
},
"id": "CVE-2026-111621-2f19a5f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "queryUserFormFixedFields"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222668158662782381167297745365090051286",
"length": 480
},
"id": "CVE-2026-111621-32ee6671",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java",
"function": "getWxNotifyQrCode"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"14987646560258484555263888700836877865",
"334634004997116795875515721872948283250",
"245418113293850881032483529307321840809",
"9094729738153368702241547237158020488",
"261325183035646362393303545198178579393",
"302719171126666772123105368506575084566",
"112899482582679909851485038505051545821",
"127577579282321025902589578133001275996",
"17811102699592408059985867572938670557",
"163125395863534716526867669521251134264",
"156416576560808060229223585617521141943",
"309158495801219664092938392877600429387",
"252043173899075376202269916533188264854",
"211062465896314570335741458836626197503",
"314631500372009517480188160832886592236",
"182031243535399862522927211793790209153",
"193416827619537305186869273583317930122",
"161230899678212576112109219919584161214",
"234118443701822414269705882463173323651",
"50047652927930514028714883143236293252",
"298288973481859403111473235500642299985",
"8892891624610220334500556122204578753",
"7445271814622979496180081608619864272",
"267813518725649157163792914009403811309",
"275510861976363877597514567933134097120",
"120590245158002570772474698430334446957",
"3791255155388477283172978228102954538",
"156586177524062362278009010868627115768"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-3370bb12",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"217741079320711662043913334417390897629",
"165544437691846228859681190250625232970",
"254525779014335523393985929724777112063",
"225225949061566926638513279555599897277"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-35502f33",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "86422703492809764199068185247978513143",
"length": 363
},
"id": "CVE-2026-111621-3c56d1c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormDashboardController.java",
"function": "formReportStats"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"324039286586551689469405541372552490046",
"160631872983917166928061273598462569311",
"10155323089671202339165812160077458217",
"55908821451315134548772765593238232414"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-43fc0780",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/TduckApiApplication.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "35806455280792172407225310373135075132",
"length": 571
},
"id": "CVE-2026-111621-5602971b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "createFormItem"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "2161975549258242402334285247771026866",
"length": 123
},
"id": "CVE-2026-111621-5a91e5fe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "queryFormByKey"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"279333368275037067404210307739612427469",
"142929811431527361729731122107389778648",
"145920480619168858522241846065157784460",
"221009578909552466328143184477288922364",
"157686524567302523502836289474226480846",
"212705329168800085776083199564471090976",
"178892247974016161590811364942490805359",
"258644957888626185520884502469093474346",
"285572903185016373082995622427168747125",
"205815128705071210159030132159488107157",
"326756183583098041643292923161021834868",
"236062887916465690930979855701157597297",
"305574406990794304271579658774535997926",
"45428813825887186311388077691615031004",
"12666975101170515470651626900381173465",
"39208773703936336764220442539446693501"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-606cb6b4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"278026141883159113715875761641651129344"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-62f3c264",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-common/src/main/java/com/tduck/cloud/envconfig/constant/ConfigConstants.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "66642330131431694807893959990406530010",
"length": 202
},
"id": "CVE-2026-111621-6bb9ffe7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java",
"function": "importFormData"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"23179076529984241018682709950790451845",
"241938136568906673215413677097464277640",
"971007538457139963864194563903731114",
"92099221303956402715769182753234718182",
"208877965712481126670570179398550574286",
"65332462635451715724739120251889221751",
"169463276417026782758855666518277969027",
"66287379663701039266563321131382423026",
"17533243906189476463285630174589786961",
"205642016401759916592704395653877184528",
"311173423264581756403556376213488607362",
"187196361075703809591308686137463013418",
"11928155784413216935996168608412625413",
"231925711966696160661358711101959899336",
"196703829013479975109823115889484284022",
"169941158835270252613022978879056216068",
"131234159448420866941680447403026063031",
"300741429273708382270488849001417815724",
"156430409529315977400060517918052090322",
"310158175394066079449609392576342085711",
"260799085378064730111098803190642524564",
"32283773397789469962459686410158253787",
"126328624347719403362821826924354761751",
"99404806570881901948589102537143122740"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-6fa137f3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233454285773180676290645397526957173151",
"length": 536
},
"id": "CVE-2026-111621-75e90102",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserController.java",
"function": "queryCurrentUser"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "6958509765221847338648613085943528600",
"length": 271
},
"id": "CVE-2026-111621-7ef01c6d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "restoreRecycleForm"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321051135769991149478883252113312954594",
"length": 245
},
"id": "CVE-2026-111621-84bdb25c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java",
"function": "deleteWxNotifyQrCode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "53157018270219504922507438282723996018",
"length": 909
},
"id": "CVE-2026-111621-923941da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java",
"function": "sortFormItem"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258525299388201335390412554679517328352",
"length": 91
},
"id": "CVE-2026-111621-95f7c336",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java",
"function": "exportFormData"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60800913544838783404744295114500739099",
"length": 721
},
"id": "CVE-2026-111621-ad1e2dbe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/listener/EnvConfigRefreshListener.java",
"function": "envConfigRefreshEvent"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45906015178335872567656102194221054538",
"length": 387
},
"id": "CVE-2026-111621-ad4ea648",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java",
"function": "saveUserFormLinkExt"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "318719118171958814228758463355444806385",
"length": 99
},
"id": "CVE-2026-111621-bafac2d2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java",
"function": "downloadImportTemplate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "95036955248508240293348045197501641088",
"length": 309
},
"id": "CVE-2026-111621-c9d4ed0e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java",
"function": "queryFormSettingByKey"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219528523028305511282268284806099347283",
"length": 170
},
"id": "CVE-2026-111621-cb83cf6d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java",
"function": "deleteFormData"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "64255515266096518673448601441604605551",
"length": 298
},
"id": "CVE-2026-111621-d3b13e09",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/TduckApiApplication.java",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "124888466623925264316783125064433576984",
"length": 452
},
"id": "CVE-2026-111621-e0c9ca02",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java",
"function": "getFormDataDetails"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215210450223256117278408782437069291803",
"length": 689
},
"id": "CVE-2026-111621-e7ae496f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java",
"function": "getWxNotifyUser"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"72059777275453993651883652598625550212",
"146710856059368189647387685282697258092",
"168888519848508964228346763979209876285",
"106919726385903324810216970703661313797",
"44574165794932490163988408140089248335",
"114697257801596235666061494921518534441",
"159532001951090462934745266818092492153",
"222024732864081817693125022846973932479",
"263884220487495981103145423361527314896",
"152537966769079994979868839724142871536",
"93125299626114514155050447863379262859",
"172397970003669351898456833629292718320",
"32674525960791450827428477164852453481",
"209304821981378450155307214145953781490",
"329818839181614150301631651050646445929",
"247546118611846162774477814286988445376"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-e8c85ab4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"338495076192546479212164339131485287370",
"91378398629357056651496826549957146287",
"119658406304095838208543691007454783190",
"297750043283241213737747197608653159050",
"131085668027758143883370352501511867429",
"277192134912985788613604292692844024084",
"258201281674434773852474739773037822728",
"273044645211350846033584871890401335473"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-eca000bd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/listener/EnvConfigRefreshListener.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "32765271862171793411763014388760346883",
"length": 96
},
"id": "CVE-2026-111621-eed9780d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java",
"function": "downloadFormResultFile"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "88480546736984069712482355545015327717",
"length": 221
},
"id": "CVE-2026-111621-ef23d5dc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java",
"function": "listUserFormLinkExt"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "75896858088556624156919114462363394883",
"length": 263
},
"id": "CVE-2026-111621-fe04b3ac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java",
"function": "deleteUserFormLinkExt"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"167011175886656729399071366005587050895",
"127278080405719090511762163679634281951",
"87567442931174945671553994736093453488",
"54241034059114120848447508815321674779"
],
"threshold": 0.9
},
"id": "CVE-2026-111621-fe82ad5f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18",
"target": {
"file": "tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormDashboardController.java"
}
}
]
"2026-10-21T09:38:20Z"