{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atducktduck_survey_form/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tduck:tduck_survey_form:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-109164"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TDuck survey form (\u003c= 6.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","idor","data-loss","impact"],"_cs_type":"advisory","_cs_vendors":["TDuck"],"content_html":"\u003cp\u003eTDuck survey form, through version 6.0, contains an insecure direct object reference (IDOR) vulnerability (CVE-2026-109164) that enables authenticated users to perform unauthorized deletions of form submissions. By manipulating the submission identifier within requests, an attacker can target and remove data belonging to other users across the platform. The vulnerability exists due to a lack of sufficient access control checks when processing submission deletion requests, allowing an attacker to iterate through sequential identifiers. This flaw poses a significant risk to data integrity and availability, as attackers can perform platform-wide data destruction. Organizations utilizing TDuck survey form should verify current versions and restrict access to the affected submission deletion functionality.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in unauthorized data loss, where an attacker can delete arbitrary form submissions regardless of ownership. This impacts data integrity and historical record availability for organizations using the platform for surveys or data collection. The platform-wide scope of this flaw allows for mass deletion, potentially affecting the entire database of submissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of TDuck survey form that addresses the IDOR vulnerability in the submission deletion logic.\u003c/li\u003e\n\u003cli\u003eImplement request monitoring to detect high volumes of deletion requests originating from a single authenticated user session.\u003c/li\u003e\n\u003cli\u003eReview access logs to identify anomalous deletion patterns, specifically those involving sequential numeric IDs.\u003c/li\u003e\n\u003cli\u003eRestrict access to the submission management portal to trusted, authorized administrators only until the vulnerability is patched.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T13:43:15Z","date_published":"2026-10-12T13:43:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tduck-idor/","summary":"TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission identifiers.","title":"IDOR Vulnerability in TDuck Survey Form","url":"https://feed.craftedsignal.io/briefs/2026-10-tduck-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:tduck:tduck_survey_form:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}