Is CVE-2026-100303 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100303?

CVE-2026-100303 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-100303

Description

TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin users can add, modify, or delete themes and theme categories affecting forms owned by other users.