CVE-2026-100305

Executive Summary

CVE-2026-100305 is a missing authorization vulnerability (CWE-862) in the TDuck survey form application through version 6.0, where the authenticated submission endpoint POST /user/form/data/create fails to enforce form fill-in restrictions. Any authenticated attacker who knows a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions. This enables falsification of collected survey results, undermining data integrity for organizations relying on TDuck for data collection.

Technical Analysis

The vulnerability resides in the TDuck survey form application, specifically within the authenticated submission endpoint POST /user/form/data/create. The core issue is a missing authorization check — CWE-862 — where the application fails to validate whether a form is currently open for submissions before accepting data.

TDuck forms are governed by several access controls that should restrict submissions:

• Publish status: Whether a form is published or in draft state
• Time window: A defined period during which submissions are accepted
• Submission quota: A maximum number of responses allowed
• Per-IP restrictions: Limits on the number of submissions from a single IP address

According to the NVD description, the POST /user/form/data/create endpoint does not enforce any of these restrictions. An attacker with valid authentication credentials and knowledge of a form's key can bypass all these controls. The "key" appears to be a form identifier or access token that, when known, grants the ability to submit data regardless of the form's intended state.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates:

• Network attack vector: Exploitable remotely
• Low attack complexity: No special conditions required
• Low privileges required: Attacker must be authenticated
• No user interaction: No victim action needed
• Scope unchanged: Impact confined to the vulnerable component
• No confidentiality impact: Data is not exposed
• Low integrity impact: Submitted data can be falsified
• No availability impact: Service remains operational

The vulnerability class is a server-side authorization bypass, where the endpoint trusts the authenticated session and form key without performing server-side validation of submission eligibility. The "through 6.0" version range suggests all versions up to and including 6.0 are affected with no known fix.

Exploitation Scenarios

The attack chain for CVE-2026-100305 follows a straightforward pattern based on the vulnerability class and available description:

1. Reconnaissance/target identification: The attacker identifies a TDuck survey form deployment, potentially through Shodan searches for http.html:"TDuck" or by discovering the application during network enumeration. The attacker must obtain valid authentication credentials — either through legitimate account creation, credential compromise, or default credentials if present.

2. Form key acquisition: The attacker needs to know a target form's key. This could be obtained through:

   • Publicly shared form links (survey invitations)
   • Enumeration of form keys if they follow a predictable pattern
   • Insider knowledge or social engineering
   • Leaked form URLs in emails, websites, or documentation

3. Exploitation via submission endpoint: Using the acquired form key, the attacker sends authenticated HTTP POST requests to /user/form/data/create. The endpoint processes each request without verifying:

   • If the form is published (draft forms can be submitted to)
   • If the current time is within the allowed submission window
   • If the submission quota has been reached
   • If the source IP has exceeded per-IP limits

   The attacker can automate this process to submit unlimited entries rapidly.

4. Post-exploitation impact: The attacker successfully falsifies collected data, skewing survey results, poll outcomes, or data collection efforts. This can be used for:

   • Manipulating business decisions based on falsified data
   • Undermining research integrity
   • Competitive sabotage by polluting a competitor's data
   • Skewing public opinion polls or feedback mechanisms

No public PoC exists; the attack chain is inferred from the vulnerability class (missing authorization) and the NVD description. The attack does not require sophisticated techniques — only authentication and the form key, making it accessible to moderately skilled attackers.

Impact Assessment

The primary impact is to data integrity, as reflected in the CVSS vector with I:L (Low integrity impact). While confidentiality and availability are unaffected, the falsification of survey data can have significant business consequences:

• Data-driven decisions compromised: Organizations using TDuck for market research, employee feedback, or customer satisfaction surveys may make incorrect strategic decisions based on manipulated data.
• Trust erosion: If falsified results become public, it undermines confidence in the organization's data collection processes.
• Compliance implications: For regulated industries (healthcare, finance, government), falsified survey data could violate data integrity requirements.
• Operational disruption: Manual verification of submissions may be required to identify and remove fraudulent entries, consuming resources.

The blast radius includes any TDuck deployment where forms collect data used for decision-making. The CVSS score of 4.3 (Medium) reflects the limited integrity impact and the requirement for authentication. However, the ease of exploitation (low complexity, no user interaction) and the potential for automated abuse at scale elevate the practical risk beyond the score suggests.

Affected systems are those running TDuck survey form software through version 6.0. No affected packages have been identified in OSV, and no patch or workaround is available from the vendor. The EPSS score has not been assigned by FIRST.org, and the vulnerability is not listed in CISA KEV, indicating no known active exploitation in the wild as of this report.

Detection Guidance

Sigma Rule

title: TDuck Form Submission Restriction Bypass
id: 7f8a9b0c-1d2e-3f4a-5b6c-7d8e9f0a1b2c
status: experimental
description: Detects excessive or unauthorized POST requests to TDuck form submission endpoint that may indicate exploitation of CVE-2026-100305
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100305
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026.100305
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/user/form/data/create'
  timeframe: 5m
  condition: selection | count() by c-ip > 20
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - sc-status
falsepositives:
  - Legitimate high-volume form submissions from authorized users
  - Automated testing or load testing
level: medium

YARA Rule

rule CVE_2026_100305_TDuck_Form_Submission_Bypass
{
    meta:
        description = "Detects HTTP requests targeting TDuck form submission endpoint vulnerable to CVE-2026-100305"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100305"
        severity = "medium"

    strings:
        $endpoint = "/user/form/data/create"
        $td = "TDuck"
        $post = "POST"
        $formkey1 = "formKey"
        $formkey2 = "form_key"

    condition:
        (uint16(0) == 0x4854 or uint16(0) == 0x4f50) and
        $endpoint and
        ($formkey1 or $formkey2 or $td) and
        $post
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100305 TDuck Form Submission Restriction Bypass Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/user/form/data/create"; nocase; threshold:type both, track by_src, count 20, seconds 300; classtype:attempted-recon; sid:2026100305; rev:1; reference:cve,2026-100305; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100305;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and url.path == "/user/form/data/create"] with runs=10

Splunk SPL Query

index=web_logs sourcetype=access_combined
| search method=POST uri="/user/form/data/create"
| bin _time span=5m
| stats count as submission_count by src_ip _time
| where submission_count > 20
| table _time src_ip submission_count

Wazuh OSSEC Rule

<group name="web,tdduck,cve-2026-100305">
  <rule id="100305" level="10" frequency="20" timeframe="300">
    <if_matched_sid>31100</if_matched_sid>
    <match>POST /user/form/data/create</match>
    <description>CVE-2026-100305 - TDuck form submission restriction bypass: excessive submissions from same source</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100305,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source)

1. Immediate mitigations:

• Restrict network access to the TDuck application to trusted networks or VPN users only, reducing the pool of authenticated attackers who can reach the endpoint.
• Implement a reverse proxy (e.g., Nginx, HAProxy) in front of TDuck to enforce rate limiting on POST /user/form/data/create per source IP and per authenticated session.
• Monitor and audit all form submissions for anomalies — sudden spikes, submissions outside business hours, or submissions to forms that should be closed.
• Where feasible, rotate form keys regularly and avoid sharing them publicly; treat form keys as sensitive credentials.
• Consider temporarily disabling the affected endpoint if forms are not actively collecting data, or add a custom WAF rule to block requests that violate form restrictions (though this requires custom logic not available out-of-the-box).

2. Patch/upgrade steps: No patch is available from the vendor. Monitor the TDuck project repository and vendor communication channels for a security update. If the project is abandoned, consider migrating to an actively maintained survey platform. Until a patch is released, apply the mitigations above.

3. Long-term hardening:

• Implement server-side authorization checks that validate form publish status, time window, submission quota, and per-IP limits at the API layer, not just the client side.
• Adopt a secure development lifecycle that includes threat modeling for authorization bypass vulnerabilities (CWE-862).
• Use centralized authorization middleware to ensure consistent enforcement across all endpoints.
• Conduct regular security assessments, including API authorization testing, for any data collection platform.
• Monitor CVE feeds and vendor advisories for TDuck and similar applications.

References

1. NVD - CVE-2026-100305: https://nvd.nist.gov/vuln/detail/CVE-2026-100305
2. CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. TDuck Project (monitor for security updates): https://github.com/tdduck (vendor repository, no advisory available)
5. FIRST EPSS: Not yet scored — https://www.first.org/epss/ (no EPSS data available for this CVE)

No public PoC, exploit code, or Nuclei template is available. CISA KEV does not list this vulnerability. No threat actor campaigns or exploit-in-the-wild evidence have been reported.