CVE-2026-109164
Executive Summary
CVE-2026-109164 is an Insecure Direct Object Reference (IDOR) vulnerability in TDuck survey form software through version 6.0. Authenticated users can delete form submissions belonging to other users by supplying arbitrary submission IDs, with the attack requiring only a valid user session and the ability to place an arbitrary formKey in the request path. Successful exploitation permanently deletes submissions platform-wide, resulting in a high availability impact and a low integrity impact with a CVSS base score of 7.1.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The vulnerability resides in the authorization logic governing access to survey form submission objects. TDuck fails to verify that the authenticated user issuing a deletion request is the owner of the target submission, resulting in a classic IDOR (CWE-639). The attack surface is the form submission deletion request, which is reachable over the network (AV:N) and requires only low privileges (PR:L) — a valid authenticated session — with no user interaction required (UI:N).
Per the NVD description, the attacker places "their own formKey in the path" while iterating sequential submission IDs in the request body. This indicates that while the request path is validated against a formKey the attacker controls, the submission identifiers supplied in the request body are not validated for ownership. Because submission IDs are sequential, an attacker can enumerate them, and any ID not belonging to the attacker is still processed and deleted. The authorization check is effectively split: the path component (formKey) is enforced, but the body parameter (submission ID) is not tied to the authenticated identity.
The resulting CVSS subscores are C:N (no confidentiality impact), I:L (low integrity impact), and A:H (high availability impact). The high availability score reflects that deletion is permanent and can affect submissions platform-wide — data loss rather than disclosure is the primary consequence. There is no public PoC, no exploit code, and no Nuclei template available as of this writing. No code-level details, function names, or file paths beyond "formKey" and "submission ids" are provided in the source data, so further implementation specifics cannot be confirmed.
Exploitation Scenarios
No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639 IDOR) and the NVD description.
Reconnaissance/target identification: The attacker identifies a TDuck survey form deployment through internet scanning or direct knowledge. TDuck exposes survey forms identified by a formKey value. The attacker registers or obtains a low-privileged authenticated account, which is sufficient given PR:L.
Triggering the flaw: Within an authenticated session, the attacker constructs a deletion request placing their own legitimate formKey in the request path. This satisfies whatever path-level authorization exists. The attacker then supplies submission IDs in the request body that do not belong to them.
Payload/execution method: Because submission IDs are sequential, the attacker iterates IDs in the request body — for example, by automating a loop over an integer range. Each request path uses the attacker-controlled formKey, so the requests are accepted, but the backend deletes the referenced submission regardless of ownership. No payload beyond a numeric identifier is required; the vulnerability is an authorization failure, not an injection flaw.
Post-exploitation impact: The attacker permanently deletes other users' form submissions. Because the deletion is not scoped to a single form owner, the description notes submissions can be removed "platform-wide." The result is irreversible data loss and potential loss of business or compliance records. No data is exfiltrated (C:N) and no privilege escalation occurs (S:U), but the availability impact is high (A:H).
Impact Assessment
The business impact is primarily loss of survey and form submission data. Organizations relying on TDuck for survey collection, feedback intake, or record-keeping face permanent deletion of participant responses, potentially across all forms on the platform. The CVSS temporal and environmental context is unknown, but the base score of 7.1 places this in the High severity band.
Affected systems are TDuck survey form deployments through version 6.0. The blast radius is broad because the flaw is not scoped to a single form or user: the description states submissions can be deleted "platform-wide." Any authenticated user can serve as the attack principal, meaning a single low-privileged account is sufficient to cause organization-wide data loss. Confidentiality is not impacted (C:N), and scope remains unchanged (S:U). The low integrity score (I:L) reflects that modification is limited to deletion of submission records rather than broader system state changes.
Detection Guidance
Sigma Rule
title: TDuck IDOR Submission Deletion Attempt
id: 8f3c1a2e-5b7d-4c9a-9e21-1c4d7f0a6b33
status: experimental
description: Detects suspicious iteration of sequential submission IDs in TDuck form submission deletion requests
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-109164
author: valtersit.com
date: 2026/01/01
logsource:
category: webserver
product: apache
detection:
selection_method:
cs-method: 'DELETE'
selection_keyword:
cs-uri-query|contains: 'formKey'
selection_body:
cs-uri-query|contains: 'submission'
condition: selection_method and selection_keyword and selection_body
fields:
- c-ip
- cs-uri
- cs-method
falsepositives:
- Legitimate bulk deletion by form owners
level: medium
YARA Rule
rule TDuck_IDOR_Submission_Delete
{
meta:
description = "Detects patterns associated with TDuck IDOR submission deletion (CVE-2026-109164)"
author = "valtersit.com"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109164"
date = "2026-01-01"
severity = "high"
strings:
$formkey = "formKey" ascii wide nocase
$submission = "submission" ascii wide nocase
$delete = "delete" ascii wide nocase
condition:
uint16(0) == 0x5A4D and all of them or
(any of ($formkey, $submission) and $delete)
}
Suricata IDS Rule
alert http any any -> any any (msg:"CVE-2026-109164 TDuck IDOR Submission Deletion Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"formKey"; http.request_body; content:"submission"; reference:cve,2026-109164; classtype:attempted-admin; sid:2026109164; rev:1;)
Elastic Detection
network where network.protocol == "http" and
http.request.method == "DELETE" and
stringContains(http.request.uri, "formKey") and
stringContains(http.request.body, "submission")
Splunk SPL Query
index=web sourcetype=access_combined OR sourcetype=proxy
| search method=DELETE uri="*formKey*"
| stats count values(uri) as uris by src_ip, user
| where count > 5
Wazuh OSSEC Rule
<group name="web,tdduck,idor,">
<rule id="2026109" level="10">
<decoded_as>web-accesslog</decoded_as>
<match>DELETE</match>
<regex>formKey.*submission</regex>
<description>CVE-2026-109164: Possible TDuck IDOR submission deletion attempt</description>
<mitre>
<id>T1190</id>
</mitre>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).
Immediate mitigations: Enforce server-side ownership checks on every deletion request, verifying that the authenticated principal owns the referenced submission ID before processing deletion. Do not rely on the formKey path parameter as the sole authorization control. Introduce a role check to limit deletion rights, and rate-limit or monitor bulk deletion requests. Where possible, disable or restrict the submission deletion feature for non-owner accounts until a fix is available.
Patch/upgrade steps: No vendor patch is available or referenced. Monitor the TDuck project for a fixed release. Until then, treat version 6.0 and earlier as vulnerable and apply compensating controls. Confirm the affected version range with the vendor, as no official affected-version list is available.
Long-term hardening: Adopt object-level authorization as a standard control (e.g., enforce ownership predicates in the data access layer). Replace sequential, guessable submission IDs with non-enumerable identifiers. Log and alert on deletion operations, and implement soft-delete with a retention window to reduce the impact of unauthorized deletions. Conduct periodic access-control testing against all CRUD endpoints.
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109164
- CWE-639: https://cwe.mitre.org/data/definitions/639.html
- MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
- FIRST CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-109164 is NOT listed as of this writing)
No public proof-of-concept, exploit code, or in-the-wild campaign evidence is currently available for CVE-2026-109164.
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.