TDuck Survey Form through 6.0 contains an insecure direct object reference flaw in the saveFormTheme endpoint that allows authenticated users to overwrite the theme of another user's form by submitting a theme ID belonging to a different form while supplying their own formKey; the attacker can replace the victim’s theme colors and image URLs, effectively vandalizing the form interface and potentially inserting malicious links.

Affected product: TDuckCloud tduck-survey-form, version 6.0 and earlier. The vulnerability is present in releases up to and including 6.0 and is not reported in later releases.

The flaw has a CVSS score of 5.3, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session; an attacker must possess formKey access and knowledge of another form’s sequential theme ID. The attack vector uses the POST /user/form/theme/save endpoint and is limited to modifying UI appearance rather than executing code or causing denial of service.