IDOR Vulnerability in TDuck Survey Form

TDuck survey form, through version 6.0, contains an insecure direct object reference (IDOR) vulnerability (CVE-2026-109164) that enables authenticated users to perform unauthorized deletions of form submissions. By manipulating the submission identifier within requests, an attacker can target and remove data belonging to other users across the platform. The vulnerability exists due to a lack of sufficient access control checks when processing submission deletion requests, allowing an attacker to iterate through sequential identifiers. This flaw poses a significant risk to data integrity and availability, as attackers can perform platform-wide data destruction. Organizations utilizing TDuck survey form should verify current versions and restrict access to the affected submission deletion functionality.

Impact

Successful exploitation of this vulnerability results in unauthorized data loss, where an attacker can delete arbitrary form submissions regardless of ownership. This impacts data integrity and historical record availability for organizations using the platform for surveys or data collection. The platform-wide scope of this flaw allows for mass deletion, potentially affecting the entire database of submissions.

Recommendation

1. Upgrade to a version of TDuck survey form that addresses the IDOR vulnerability in the submission deletion logic.
2. Implement request monitoring to detect high volumes of deletion requests originating from a single authenticated user session.
3. Review access logs to identify anomalous deletion patterns, specifically those involving sequential numeric IDs.
4. Restrict access to the submission management portal to trusted, authorized administrators only until the vulnerability is patched.