Description

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:29.200Z",
  "pubdate": "2026-10-12T13:17:29.200Z",
  "executiveSummary": "TDuck survey form through 6.0 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the saveFormTheme handler. This flaw allows an authenticated attacker to manipulate theme identifiers to gain unauthorized access to the theme configurations of other users.\nThe vulnerability stems from improper server-side authorization checks when processing theme update requests. By supplying an arbitrary, sequential theme ID associated with a different user's form, an attacker can overwrite the target's theme settings, including custom color palettes and external image URLs.\nThe impact is significant, as successful exploitation results in the permanent modification or deletion of a victim's form presentation settings. This unauthorized state change compromises the integrity of the user's data and can lead to a complete loss of the victim's branding and design configurations.\nExploitation requires the attacker to hold an authenticated account within the platform and possess a valid formKey. Since the application fails to validate whether the current user maintains ownership or access rights to the target theme ID provided in the saveFormTheme request, the security boundary between different user forms is effectively bypassed.",
  "technicalDetails": "The vulnerability is localized within the saveFormTheme function, which acts as the backend handler for updating form aesthetic configurations. The primary security failure is a classic Insecure Direct Object Reference (IDOR) condition where the application accepts a sequential theme identifier as an input parameter without verifying the authorization context of the requesting session.\nThe attack flow proceeds as follows: First, the attacker identifies a valid, sequential theme ID belonging to another user. Because the system utilizes predictable, incrementing identifiers, these targets can be easily enumerated or guessed. Second, the attacker prepares a malicious request targeting the saveFormTheme endpoint, utilizing their own authenticated formKey while substituting the intended victim's theme ID in the request parameters.\nUpon receiving the request, the server fails to execute an ownership verification check. Instead of ensuring that the theme ID associated with the incoming request actually belongs to the authenticated user's formKey, the application proceeds to update the database record associated with the supplied theme ID. This causes the server to apply the attacker's submitted color schemes and image resource URLs to the victim's theme configuration.\nThe payload behavior involves the systematic overwriting of existing theme metadata. By submitting these crafted parameters, the attacker forces the application to replace legitimate visual settings with their own. Furthermore, the logic inherent in the handler results in the effective removal or displacement of the victim's original theme configuration, as the system treats the overwrite request as a legitimate update operation.\nThis vulnerability is present in all versions up to and including 6.0. It requires a baseline level of authentication to reach the affected endpoint, but no specific administrative privileges are necessary to perform the attack. The exploit is highly efficient, as it does not rely on complex injection patterns, but rather on the lack of server-side object-level access control. The post-exploitation impact includes unauthorized modification of web assets, potential defacement of public-facing survey forms, and the loss of availability regarding the original theme state for the victim."
}