The vulnerability in TDuck Survey Form (up to version 5.3) allows an authenticated user to read the raw settings of any form owned by another user through the unrestricted GET endpoint /user/form/setting/{key}. An attacker can supply the 8-character key that appears in a public fill link and retrieve sensitive configuration data such as the form write password, owner notification e‑mail address, and a list of WeChat openIds. The flaw is a missing authorization check for this endpoint, specifically classified as CWE‑639. The impact is loss of confidentiality for form owners and potential for further compromise of owner accounts.

Affected product: TDuckCloud tduck-survey-form, version 5.3. Based on available vendor documentation, no other versions have been confirmed as vulnerable. Users of older releases should verify whether the issue is present in their deployed instances.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need to be authenticated to the system; there is no privilege escalation or other prerequisites. Because the endpoint accepts an arbitrary key, anyone with access to a public form link can exfiltrate another owner’s restricted data, making exploitation straightforward. The risk level is moderate, but the potential exposure of private owner data warrants timely remediation.