The vulnerability in TDuck survey form through 6.0 arises because the FormThemeController write endpoints for global form themes and categories lack proper authorization checks. Authenticated non‑admin users can add, modify, or delete themes and theme categories that affect forms owned by other users, granting them the ability to alter the visual appearance and potentially mislead end‑users or obscure confidential data. Affected systems are TDuck Cloud’s tduck‑survey‑form application, specifically versions up to and including 6.0. The issue is present in the FormThemeController implementation located in the tduck‑survey‑form source code. The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the endpoints can be reached over the web by any authenticated user, the likely attack vector is a web‑based request that bypasses role checks. An attacker requires valid user credentials but does not need administrative privileges to exploit the weakness.

TDuck Cloud’s tduck‑survey‑form application, versions up to and including 6.0.

The CVSS score of 5.3 reflects moderate impact, and the lack of an EPSS score suggests limited publicly known exploitation activity. The vulnerability is not in the CISA KEV list, but the presence of functional web endpoints that accept write operations without proper role verification implies a moderate risk of exploitation once authentication credentials are compromised or obtained via credential‑reuse vectors. Attackers can modify themes used by other users, potentially causing confusion or facilitating social engineering. The exploitation requires only the ability to authenticate to the application, making the condition relatively easy for attackers who have compromised user accounts.