TDuck survey form 6.0 contains a failure‑open authorization check in FormAuthUtils.hasPermission. When a form is permanently deleted, the check does not reject access, allowing any authenticated user to call the GET /user/form/data/details endpoint with a known dataId and retrieve the associated submission data. The data may contain personal identifiers, emails, phone numbers, and other sensitive fields. This behavior matches CWE-636, where insufficient authorization allows disclosure of information that should be protected.

The vulnerable component is the TDuckCloud tduck-survey-form web application, running version 6.0. The issue is present in the current 6.0 release and applies to any deployment that has this version without an update that fixes the double‑check in the ownership validation code.

The CVSS score of 6 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated against the TDuck system, which may be a legitimate user or someone who has compromised credentials. With a valid dataId, the attacker can access arbitrary deleted form submissions, thereby breaching confidentiality of user data. The attack vector is remote over HTTP, requiring only knowledge of the correct endpoint and a valid session. Although exploitation requires authentication, the medium CVSS reflects the potential data leakage and the ground‑up nature of the vulnerability.