{"id":"CVE-2026-111621","summary":"TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}","details":"TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.","modified":"2026-10-21T09:38:20.804165237Z","published":"2026-10-16T17:38:58.051Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111621.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111621.json"},{"type":"PACKAGE","url":"https://github.com/TDuckCloud/tduck-survey-form"},{"type":"ARTICLE","url":"https://github.com/TDuckCloud/tduck-survey-form/blob/5.3/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java#L66-L75"},{"type":"FIX","url":"https://github.com/TDuckCloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/tduck-survey-form-setting-cross-user-disclosure"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111621"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-missing-authorization-via-user-form-setting-key"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tduckcloud/tduck-survey-form","events":[{"introduced":"0"},{"last_affected":"bb28d307842288502cc24b3962243c75a2514ed5"},{"fixed":"984efd69f51778e3d1a9ea0feb0f7c9aed266c18"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"5.3"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"984efd69f51778e3d1a9ea0feb0f7c9aed266c18"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["5.3","5.2","5.1","v5.0","v4.0","v2.1.0","v0.0.1-beta"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java","function":"batchCreateFormItem"},"deprecated":false,"digest":{"function_hash":"1379599561389503384454524564678227034","length":225},"id":"CVE-2026-111621-172885d6"},{"target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java","function":"queryUserFormFields"},"deprecated":false,"digest":{"function_hash":"58728522169065426406257718377540647448","length":116},"id":"CVE-2026-111621-1e581e7f","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18"},{"digest":{"line_hashes":["265244318536226339159707887267683410185","167156236538422751092220032681735849962","166360963634660081679343117978614091406","327109217212637911568179901973762788965","64145582720435758215080140101698494409","198406352332165058109975714532187319490","182294923730163039062731146157670044757","151376927146945788008942019674103809641","209017288450264055638272744538488369809","323764583651997195649587748271813799427","258349174189355243478977693644236916111","120942732361452467479684925358931777843","233280955741370187754880915344199647330","319550607601779556184065392232235516563","154323239163563661213405239462627073208","235891048694368774295934157275334379550"],"threshold":0.9},"id":"CVE-2026-111621-271d535d","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java"},"deprecated":false},{"id":"CVE-2026-111621-2f19a5f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java","function":"queryUserFormFixedFields"},"deprecated":false,"digest":{"function_hash":"1133215329101806224896849748604487910","length":681}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java","function":"getWxNotifyQrCode"},"deprecated":false,"digest":{"function_hash":"222668158662782381167297745365090051286","length":480},"id":"CVE-2026-111621-32ee6671","signature_type":"Function"},{"digest":{"line_hashes":["14987646560258484555263888700836877865","334634004997116795875515721872948283250","245418113293850881032483529307321840809","9094729738153368702241547237158020488","261325183035646362393303545198178579393","302719171126666772123105368506575084566","112899482582679909851485038505051545821","127577579282321025902589578133001275996","17811102699592408059985867572938670557","163125395863534716526867669521251134264","156416576560808060229223585617521141943","309158495801219664092938392877600429387","252043173899075376202269916533188264854","211062465896314570335741458836626197503","314631500372009517480188160832886592236","182031243535399862522927211793790209153","193416827619537305186869273583317930122","161230899678212576112109219919584161214","234118443701822414269705882463173323651","50047652927930514028714883143236293252","298288973481859403111473235500642299985","8892891624610220334500556122204578753","7445271814622979496180081608619864272","267813518725649157163792914009403811309","275510861976363877597514567933134097120","120590245158002570772474698430334446957","3791255155388477283172978228102954538","156586177524062362278009010868627115768"],"threshold":0.9},"id":"CVE-2026-111621-3370bb12","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java"},"deprecated":false},{"source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserController.java"},"deprecated":false,"digest":{"line_hashes":["217741079320711662043913334417390897629","165544437691846228859681190250625232970","254525779014335523393985929724777112063","225225949061566926638513279555599897277"],"threshold":0.9},"id":"CVE-2026-111621-35502f33","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"function":"formReportStats","file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormDashboardController.java"},"deprecated":false,"digest":{"function_hash":"86422703492809764199068185247978513143","length":363},"id":"CVE-2026-111621-3c56d1c3"},{"id":"CVE-2026-111621-43fc0780","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/TduckApiApplication.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["324039286586551689469405541372552490046","160631872983917166928061273598462569311","10155323089671202339165812160077458217","55908821451315134548772765593238232414"]}},{"source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java","function":"createFormItem"},"deprecated":false,"digest":{"function_hash":"35806455280792172407225310373135075132","length":571},"id":"CVE-2026-111621-5602971b","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"2161975549258242402334285247771026866","length":123},"id":"CVE-2026-111621-5a91e5fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java","function":"queryFormByKey"},"deprecated":false},{"digest":{"line_hashes":["279333368275037067404210307739612427469","142929811431527361729731122107389778648","145920480619168858522241846065157784460","221009578909552466328143184477288922364","157686524567302523502836289474226480846","212705329168800085776083199564471090976","178892247974016161590811364942490805359","258644957888626185520884502469093474346","285572903185016373082995622427168747125","205815128705071210159030132159488107157","326756183583098041643292923161021834868","236062887916465690930979855701157597297","305574406990794304271579658774535997926","45428813825887186311388077691615031004","12666975101170515470651626900381173465","39208773703936336764220442539446693501"],"threshold":0.9},"id":"CVE-2026-111621-606cb6b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java"},"deprecated":false},{"digest":{"line_hashes":["278026141883159113715875761641651129344"],"threshold":0.9},"id":"CVE-2026-111621-62f3c264","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-common/src/main/java/com/tduck/cloud/envconfig/constant/ConfigConstants.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"66642330131431694807893959990406530010","length":202},"id":"CVE-2026-111621-6bb9ffe7","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"function":"importFormData","file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java"}},{"target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java"},"deprecated":false,"digest":{"line_hashes":["23179076529984241018682709950790451845","241938136568906673215413677097464277640","971007538457139963864194563903731114","92099221303956402715769182753234718182","208877965712481126670570179398550574286","65332462635451715724739120251889221751","169463276417026782758855666518277969027","66287379663701039266563321131382423026","17533243906189476463285630174589786961","205642016401759916592704395653877184528","311173423264581756403556376213488607362","187196361075703809591308686137463013418","11928155784413216935996168608412625413","231925711966696160661358711101959899336","196703829013479975109823115889484284022","169941158835270252613022978879056216068","131234159448420866941680447403026063031","300741429273708382270488849001417815724","156430409529315977400060517918052090322","310158175394066079449609392576342085711","260799085378064730111098803190642524564","32283773397789469962459686410158253787","126328624347719403362821826924354761751","99404806570881901948589102537143122740"],"threshold":0.9},"id":"CVE-2026-111621-6fa137f3","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18"},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserController.java","function":"queryCurrentUser"},"deprecated":false,"digest":{"function_hash":"233454285773180676290645397526957173151","length":536},"id":"CVE-2026-111621-75e90102","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"function":"restoreRecycleForm","file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java"},"deprecated":false,"digest":{"function_hash":"6958509765221847338648613085943528600","length":271},"id":"CVE-2026-111621-7ef01c6d","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java","function":"deleteWxNotifyQrCode"},"deprecated":false,"digest":{"function_hash":"321051135769991149478883252113312954594","length":245},"id":"CVE-2026-111621-84bdb25c","signature_type":"Function"},{"id":"CVE-2026-111621-923941da","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java","function":"sortFormItem"},"deprecated":false,"digest":{"function_hash":"53157018270219504922507438282723996018","length":909}},{"id":"CVE-2026-111621-95f7c336","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java","function":"exportFormData"},"deprecated":false,"digest":{"function_hash":"258525299388201335390412554679517328352","length":91}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/listener/EnvConfigRefreshListener.java","function":"envConfigRefreshEvent"},"deprecated":false,"digest":{"length":721,"function_hash":"60800913544838783404744295114500739099"},"id":"CVE-2026-111621-ad1e2dbe","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"45906015178335872567656102194221054538","length":387},"id":"CVE-2026-111621-ad4ea648","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"function":"saveUserFormLinkExt","file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java"}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java","function":"downloadImportTemplate"},"deprecated":false,"digest":{"function_hash":"318719118171958814228758463355444806385","length":99},"id":"CVE-2026-111621-bafac2d2","signature_type":"Function"},{"source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java","function":"queryFormSettingByKey"},"deprecated":false,"digest":{"function_hash":"95036955248508240293348045197501641088","length":309},"id":"CVE-2026-111621-c9d4ed0e","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"219528523028305511282268284806099347283","length":170},"id":"CVE-2026-111621-cb83cf6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java","function":"deleteFormData"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"64255515266096518673448601441604605551","length":298},"id":"CVE-2026-111621-d3b13e09","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/TduckApiApplication.java","function":"main"}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java","function":"getFormDataDetails"},"deprecated":false,"digest":{"function_hash":"124888466623925264316783125064433576984","length":452},"id":"CVE-2026-111621-e0c9ca02","signature_type":"Function"},{"deprecated":false,"digest":{"length":689,"function_hash":"215210450223256117278408782437069291803"},"id":"CVE-2026-111621-e7ae496f","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"function":"getWxNotifyUser","file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java"}},{"digest":{"line_hashes":["72059777275453993651883652598625550212","146710856059368189647387685282697258092","168888519848508964228346763979209876285","106919726385903324810216970703661313797","44574165794932490163988408140089248335","114697257801596235666061494921518534441","159532001951090462934745266818092492153","222024732864081817693125022846973932479","263884220487495981103145423361527314896","152537966769079994979868839724142871536","93125299626114514155050447863379262859","172397970003669351898456833629292718320","32674525960791450827428477164852453481","209304821981378450155307214145953781490","329818839181614150301631651050646445929","247546118611846162774477814286988445376"],"threshold":0.9},"id":"CVE-2026-111621-e8c85ab4","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/listener/EnvConfigRefreshListener.java"},"deprecated":false,"digest":{"line_hashes":["338495076192546479212164339131485287370","91378398629357056651496826549957146287","119658406304095838208543691007454783190","297750043283241213737747197608653159050","131085668027758143883370352501511867429","277192134912985788613604292692844024084","258201281674434773852474739773037822728","273044645211350846033584871890401335473"],"threshold":0.9},"id":"CVE-2026-111621-eca000bd"},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java","function":"downloadFormResultFile"},"deprecated":false,"digest":{"length":96,"function_hash":"32765271862171793411763014388760346883"},"id":"CVE-2026-111621-eed9780d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"88480546736984069712482355545015327717","length":221},"id":"CVE-2026-111621-ef23d5dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java","function":"listUserFormLinkExt"}},{"deprecated":false,"digest":{"length":263,"function_hash":"75896858088556624156919114462363394883"},"id":"CVE-2026-111621-fe04b3ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormPublishController.java","function":"deleteUserFormLinkExt"}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/984efd69f51778e3d1a9ea0feb0f7c9aed266c18","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormDashboardController.java"},"deprecated":false,"digest":{"line_hashes":["167011175886656729399071366005587050895","127278080405719090511762163679634281951","87567442931174945671553994736093453488","54241034059114120848447508815321674779"],"threshold":0.9},"id":"CVE-2026-111621-fe82ad5f","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-21T09:38:20Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111621.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}