TDuck survey form through 6.0 contains a broken access control flaw that lets an authenticated user add custom fields to other users’ publicly available forms. By crafting a POST request to /user/form/item/batch/create, the attacker can supply a list of form identifiers where the first element is the attacker's own form and subsequent elements reference a victim’s formKey. This injects attacker’s chosen fields onto the victim’s form page, enabling data tampering and potential phishing or data leakage. The vulnerability is specified as CWE-639, indicating a lack of identity or authorization checks.

The flaw is present in the TDuckCloud tduck-survey-form product version 6.0 and earlier. The specific CPE is not detailed, but all releases up to 6.0 are affected.

The CVSS score of 5.3 reflects a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated account and exploits the POST /user/form/item/batch/create endpoint. Attackers can obtain these credentials via normal user login or other credential-based attacks. Once authenticated, they can take advantage of the missing authorization checks to modify other users’ forms.