CVE-2026-92567

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92567

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92567.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92567

Published

2026-09-16T14:40:47Z

Modified

2026-09-19T03:30:22Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

TDuck survey form through 5.0 Unauthorized Data Modification

Details

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92567.json"
}

References

Affected packages

Git / github.com/tduckcloud/tduck-survey-form

Affected ranges

Type

GIT

Repo

https://github.com/tduckcloud/tduck-survey-form

Events

Introduced

Fixed

53a5dfbc659ff9a6b979274d23e7a838198230fb

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "5.0"
        },
        {
            "fixed":  "5.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.0.1-beta

v2.*

v2.1.0

v4.*

v4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92567.json"