CVE-2026-109164

HighCVSS 7.1/10Last modified Oct 16, 2026

Description

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 12, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1091654.3TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' fCVE-2026-1091666.5lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs CVE-2026-1091674.3TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticaCVE-2026-1091686.5lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business CVE-2026-1091696.5LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via tCVE-2026-109178.3Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised thCVE-2026-1091706.5LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to CVE-2026-1091714.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject cCVE-2026-1091724.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject rCVE-2026-1091734.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject iCVE-2026-1091746.5MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials CVE-2026-1091754.3MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other admin
CVE-2026-109164: High severity, CVSS 7.1 | Vulnix