CVE-2026-109167

Executive Summary

CVE-2026-109167 is an Insecure Direct Object Reference (IDOR) vulnerability in TDuck survey form software through version 6.0, specifically affecting the saveFormTheme handler. Any authenticated user can supply a sequential theme identifier belonging to another user's form and overwrite the victim's theme colors and image URLs, effectively removing the victim's theme configuration. With a CVSS score of 4.3, the vulnerability has low direct confidentiality and availability impact but enables cross-tenant data integrity manipulation in multi-user survey deployments.

Technical Analysis

The vulnerability resides in the saveFormTheme handler of TDuck, a survey/form-building application. The handler does not validate whether the theme identifier submitted by the requesting user belongs to a form the user owns. Because theme IDs are sequential, an attacker can enumerate valid theme IDs and submit any of them alongside their own formKey to overwrite the associated theme record.

The core flaw is CWE-639 (Authorization Bypass Through User-Controlled Key). The application accepts a client-controlled object reference (the theme ID) and acts on it without an ownership or authorization check. The attack surface is the authenticated HTTP endpoint that exposes saveFormTheme, reachable over the network (AV:N). No user interaction is required from the victim (UI:N), and the attacker only requires a low-privilege authenticated account (PR:L).

The description notes that the attack is relevant to "attackers whose form has no theme" — meaning the attacker manipulates their own theme assignment to reference a foreign theme ID. This is a horizontal privilege escalation across user or tenant boundaries. The impact is scoped (S:U), affecting only the integrity of theme data (I:L), with no loss of confidentiality (C:N) or availability (A:N) according to the CVSS vector.

Because the NVD description is the sole authoritative source, the precise validation sequence, parameter names beyond formKey and the theme ID, and the exact route are not detailed. What is clear is that the theme ID is not bound to the authenticated principal's ownership context.

Exploitation Scenarios

1. Reconnaissance and target identification. The attacker authenticates with a low-privilege account and creates or accesses a form. By observing their own theme ID, the attacker infers that theme identifiers are sequential and can enumerate nearby IDs belonging to other users' forms. No public PoC exists; this chain is inferred from the described vulnerability class.

2. Triggering the flaw. The attacker issues a request to the saveFormTheme handler, supplying their own formKey alongside a theme ID that does not belong to them. Because the handler fails to verify ownership of the referenced theme, it processes the request as if the theme belonged to the attacker's form.

3. Payload/execution. The attacker submits theme content (colors and image URLs) in place of the victim's configuration. The overwrite replaces the victim's stored theme properties. This is an at-the-application-layer data manipulation rather than code execution; no remote code execution is involved.

4. Post-exploitation impact. The victim's form theme is replaced or removed. Colors and image URLs are altered, which can deface a public-facing survey, inject unexpected image resources, or disrupt branding. The integrity loss is low severity and reversible if backups exist, but it can be leveraged for social engineering (e.g., replacing a logo image URL with an attacker-controlled image) or reputational damage.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yields a base score of 4.3 (Medium). Business impact centers on data integrity and trust: form themes are user-configurable presentation data, and their unauthorized modification can lead to defacement or malicious image substitution in surveys that may be publicly visible. Because the scope is unchanged and no confidentiality or availability loss occurs, the blast radius is limited to users or tenants sharing the same TDuck instance with predictable theme IDs. In multi-tenant or shared deployments, the cross-tenant modification of presentation assets could violate data-integrity expectations and compliance obligations, even though the technical severity remains low.

Detection Guidance

Sigma Rule

title: TDuck saveFormTheme IDOR — Unauthorized Theme Overwrite
id: 8f4b2c9e-3a1d-4e7b-9c2f-1d6a5b8e0c34
status: experimental
description: Detects requests to the TDuck saveFormTheme handler where the submitted theme ID differs from the authenticated user's owned form theme, indicative of CWE-639 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109167
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'saveFormTheme'
  selection_method:
    cs-method: 'POST'
  condition: selection_endpoint and selection_method
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate users editing their own form themes
level: medium
tags:
  - attack.t1190
  - cwe.639

YARA Rule

rule CVE_2026_109167_TDuck_SaveFormTheme_IDOR
{
    meta:
        author = "valtersit.com"
        description = "Detects TDuck saveFormTheme IDOR exploitation attempts in HTTP request logs or memory"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109167"
        date = "2026-01-01"
        cve = "CVE-2026-109167"
    strings:
        $handler = "saveFormTheme" ascii nocase
        $formkey = "formKey" ascii nocase
        $theme = "theme" ascii nocase
    condition:
        $handler and ($formkey or $theme)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109167 TDuck saveFormTheme IDOR Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"saveFormTheme"; nocase; http.request_body; content:"formKey"; nocase; http.request_body; content:"theme"; nocase; sid:2026109167; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-109167, affected_product TDuck;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [any where event.category == "web" and http.request.method == "POST" and http.request.uri : "*saveFormTheme*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*saveFormTheme*" method=POST
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, user, uri_path, uri_query, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,tdruck,">
  <rule id="109167" level="7">
    <if_sid>31100</if_sid>
    <match>saveFormTheme</match>
    <description>CVE-2026-109167: Possible TDuck saveFormTheme IDOR exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109167,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Enforce server-side ownership validation in the saveFormTheme handler: reject any theme ID that is not tied to the authenticated user's formKey. If source changes are not immediately deployable, restrict the endpoint to administrators or apply a reverse-proxy access-control rule. Add rate limiting and monitoring to detect sequential theme ID enumeration.
2. Patch/upgrade steps. No vendor patch is available as of this report. Monitor the TDuck project repository and vendor channels for a fixed release beyond version 6.0. Validate any vendor update against the CWE-639 pattern before deploying. Do not rely on client-side parameterization as a fix.
3. Long-term hardening. Replace sequential identifiers with unguessable UUIDs or use indirect reference maps. Enforce object-level authorization checks on every data-modifying endpoint. Adopt tenant isolation at the query layer (e.g., scope queries by owner ID). Add regression tests that verify cross-user object access is denied.

References

• NVD — CVE-2026-109167: https://nvd.nist.gov/vuln/detail/CVE-2026-109167
• CWE-639 (Authorization Bypass Through User-Controlled Key): https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored as of report date): https://www.first.org/epss/
• CISA KEV catalog (CVE not listed; no exploit-in-the-wild evidence): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or in-the-wild exploitation evidence are available for this CVE. No public PoC, exploit code, or Nuclei template has been observed. The attack chain described is inferred from the vulnerability class and NVD description.