TDuckCloud surveys fail to enforce fill‑in restrictions on the authenticated POST /user/form/data/create endpoint due to an Access Control weakness (CWE-862). When an attacker supplies a valid form key, any authenticated user can submit unlimited entries to the form, bypassing publish status, time window, quota, and per‑IP limits that are otherwise intended to protect the questionnaire data. This flaw can lead to data falsification and compromise the integrity of collected results.

The vulnerability affects TDuckCloud tduck‑survey‑form through version 6.0. Any deployment running this version or earlier that exposes the authenticated creation endpoint is susceptible, provided the attacker has valid credentials and knows a form key.

The CVSS score of 5.3 indicates moderate risk; there is no EPSS data and the flaw is not listed in CISA KEV. Exploitation requires a valid authenticated session and knowledge of a form key, so the attack vector is remote network access to the authenticated endpoint. Once exploited, the attacker can submit arbitrary data, undermining the confidentiality and integrity of survey results.