The vulnerability is an insecure direct object reference that permits any authenticated user to delete form submissions belonging to other users by specifying arbitrary submission identifiers. An attacker can supply the target’s form identifier in the request path and iterate through submission IDs in the request body, causing permanent removal of records across the platform. The weakness is a classic IDOR (CWE‑639) and results in loss of data integrity and availability for impacted users.

The flaw exists in TDuckCloud’s tduck-survey-form component through version 6.0. All installations running 6.0 or earlier are susceptible, regardless of patch status in newer releases.

The CVSS score of 7.1 reflects a high severity for authenticated users. Since EPSS data is unavailable and the vulnerability is not listed in CISA KEV, the overall threat level is moderate but non‑trivial. Attackers only need valid credentials to exercise the deletion endpoint, meaning any user with access can compromise other users’ data if the IDOR is not mitigated. The threat vector is authenticated, internal, and can lead to significant data loss across the platform.