CVE-2026-109165

Executive Summary

CVE-2026-109165 is a broken access control vulnerability in TDuck survey form software through version 6.0 that allows any authenticated user to inject attacker-chosen fields into other users' forms. By submitting a batch request to the /user/form/item/batch/create endpoint containing an array of field definitions, an attacker can reference their own form in the first element while referencing a victim's formKey in subsequent elements, bypassing per-form ownership checks. The impact is unauthorized modification of victim form content (integrity, low severity, CVSS 4.3), potentially enabling phishing-style field injection on public fill pages. No public PoC, exploit code, or patch currently exists.

Technical Analysis

TDuck is a survey/form-collection platform. The vulnerable component is the batch field-creation handler reachable at the HTTP path POST /user/form/item/batch/create. The endpoint accepts a batch (array) of form item/field definitions rather than a single field.

The root cause is an object-level authorization failure classified as CWE-639 ("Authorization Bypass Through User-Controlled Key"). The handler appears to validate ownership of the first element in the submitted array — which an authenticated attacker can point at a form they legitimately own — but does not re-validate ownership for every subsequent element in the same batch. Later elements can carry a formKey that belongs to a different user. Because the formKey is a user-controllable key used to select the target form, the authorization decision is made against attacker-controlled input, producing the bypass.

Net effect per the NVD description: an authenticated attacker injects fields of their choosing onto a victim's form, and those injected fields render on the victim's public fill page. This is a horizontal privilege escalation / IDOR-class flaw. The batch semantics (first element "trusted," subsequent elements not individually checked) are the specific mechanism that makes it exploitable in a single request.

Attack surface: any authenticated account on the TDuck instance. No special role is required, and no interaction from the victim is needed at exploit time. The only precondition is knowledge or prediction of the victim's formKey. CVSS reflects this: network vector (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), scope unchanged (S:U), no confidentiality impact (C:N), low integrity impact (I:L), no availability impact (A:N).

Note: The description does not disclose the exact JSON/body schema, formKey format, or session mechanism. Those details are not reproduced or invented here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker registers or obtains a low-privilege authenticated account on the targeted TDuck instance (≤6.0). Forms on TDuck are addressed by a formKey; the attacker enumerates or otherwise obtains a victim's formKey (for example, from a shared/leaked public fill-page link, since victim forms are exposed as public fill pages). The attacker also creates their own form to obtain a formKey they legitimately control.

2. Triggering the flawed authorization path. The attacker sends an authenticated POST request to /user/form/item/batch/create. The request body is an array of field definitions. The first element references the attacker's own form, which satisfies whatever per-request ownership check the endpoint performs. Later elements in the same array reference the victim's formKey. Because the handler does not re-check ownership per element (CWE-639), the batch is accepted.

3. Payload / execution (class level). The "payload" is the set of field/item definitions the attacker chooses. These are persisted as new fields on the victim's form. There is no memory corruption or code execution; the exploitation primitive is unauthorized write of structured form-field data to another user's form object.

4. Post-exploitation impact. The injected fields appear on the victim's public fill page — the page the victim's respondents use. The attacker can therefore alter what respondents see or are asked to submit (for example, added input fields whose data lands in the victim's collected responses). Integrity of the victim's form is compromised; confidentiality and availability are not directly affected. Depending on the field types accepted, this can enable data-harvesting or deceptive content on a page that end users trust because it belongs to the victim organization.

Impact Assessment

• Confidentiality (C:N): None directly. The flaw writes data to a victim form; it does not read victim data.
• Integrity (I:L): Low. Attacker-chosen fields are injected into another user's form and rendered on its public fill page, tampering with form content and any downstream data collection.
• Availability (A:N): None.
• Scope (S:U): Unchanged — the vulnerable component remains the authorization logic of the same application.
• Business impact: Reputational and trust impact for the form owner; potential for social-engineering/data-harvesting against the owner's respondents due to injected fields on a trusted public page. Where forms collect PII or feed downstream workflows, injected fields can pollute or redirect collected data.
• Affected systems / blast radius: All TDuck deployments through 6.0 that expose the /user/form/item/batch/create endpoint and allow self-registration or multiple tenant users. Single-tenant deployments with fully trusted users have reduced exposure. Blast radius is limited by the low integrity-only impact and the requirement for a valid victim formKey.
• Exploitability context: Low privileges required (authenticated), no user interaction, network-reachable, low complexity — but impact is bounded (integrity only). EPSS has not been scored by FIRST.org; CISA KEV does not list this CVE. No public exploit code or Nuclei template exists.

Detection Guidance

Sigma Rule

title: TDuck Broken Access Control - Suspicious Batch Field Creation (CVE-2026-109165)
id: 7c2b9f14-tduck-batch-idor-2026
status: experimental
description: Detects POST requests to the TDuck batch form-item creation endpoint, which may be abused to inject fields into other users' forms via CWE-639.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109165
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|endswith: '/user/form/item/batch/create'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
level: medium
tags:
  - attack.t1190
  - cve.2026.109165
  - cwe.639

YARA Rule

rule CVE_2026_109165_TDuck_Batch_BAC
{
    meta:
        description = "Detects references to the TDuck vulnerable batch endpoint in logs or captured traffic (CVE-2026-109165, CWE-639)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109165"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep   = "/user/form/item/batch/create" ascii wide nocase
        $meth = "POST" ascii
        $fk   = "formKey" ascii wide nocase

    condition:
        $ep and (uint16(0) == 0x4854 or filesize < 5MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109165 TDuck Broken Access Control - Batch Form Item Creation"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/user/form/item/batch/create"; nocase; classtype:attempted-user; reference:cve,2026-109165; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109165; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026109165; rev:1;)

Elastic Detection

// Detect authenticated POSTs to the TDuck batch field-creation endpoint (potential CWE-639 abuse)
any where event.category == "web" and
          http.request.method == "POST" and
          stringContains(http.request.path, "/user/form/item/batch/create")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=apache:access
| search method=POST uri_path="/user/form/item/batch/create" OR uri="/user/form/item/batch/create*"
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip, user, uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,tddck,cve-2026-109165,">
  <rule id="100916" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <regex>POST /user/form/item/batch/create</regex>
    <description>CVE-2026-109165: TDuck batch form-item creation request (possible broken access control / field injection)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,cve_2026_109165,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict or block access to POST /user/form/item/batch/create at the WAF/reverse proxy for untrusted or self-registered users until a fix is available.
• Enforce server-side authorization that validates ownership of every element in the batch array (re-check each formKey against the authenticated user), not only the first element. This is the core CWE-639 fix.
• Reduce the attack surface where possible: disable open self-registration on the TDuck instance, and rotate/avoid predictable formKey values so victim forms cannot be trivially enumerated.
• Monitor the request path for anomalous batch submissions and correlate with authenticated user sessions (see Detection Guidance).

2. Patch / upgrade steps

• No vendor patch is available for TDuck through 6.0 as of this writing (no patch evidence from tracked sources; vendor fix N/A).
• Track the vendor's release channel and apply a fixed build as soon as one is published. Until then, rely on the compensating controls above.
• If TDuck is unsupported, evaluate replacement/migration or front it behind a proxy that enforces per-object authorization.

3. Long-term hardening

• Adopt object-level authorization (ownership checks on every object referenced by user input) as a standard pattern; treat any user-supplied key that selects a resource as an authorization input requiring validation.
• Add automated tests asserting that batch/multi-object endpoints reject foreign object references.
• Deploy WAF/IDS coverage for the batch endpoint and alert on cross-user formKey references.

References

• NVD — CVE-2026-109165: https://nvd.nist.gov/vuln/detail/CVE-2026-109165
• CWE-639 (Authorization Bypass Through User-Controlled Key): https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (not listed; check status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109165 at this time. No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class (CWE-639) and the NVD description.