CVE-2026-109167

🗓️ 12 Oct 2026 13:10:32Reported by VulnCheckType

Authenticated IDOR in TDuck survey form saveFormTheme allows overwriting other form themes.

Reporter	Title	Published	Views	Family All 4
Circl	CVE-2026-109167	12 Oct 202613:18	–	circl
Cvelist	CVE-2026-109167 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save	12 Oct 202613:10	–	cvelist
EUVD	EUVD-2026-97373	12 Oct 202613:10	–	euvd
NVD	CVE-2026-109167	12 Oct 202613:17	–	nvd

Vulners

Node

tduckcloud tduck-survey-formRange0–6.0

[
  {
    "vendor": "TDuckCloud",
    "product": "tduck-survey-form",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "6.0",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "collectionURL": "https://github.com/TDuckCloud/tduck-survey-form",
    "repo": "https://github.com/TDuckCloud/tduck-survey-form"
  }
]

Source	Link
github	www.github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_user_form_theme_save_id_confusion.py
github	www.github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java
vulncheck	www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-theme-id-in-post-user-form-theme-save

12 Oct 2026 13:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

CVSS 45.3

CWE-639