Is CVE-2026-109167 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109167?

CVE-2026-109167 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109167

Description

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.