CVE-2026-92602CWE-918ssrf

CVE-2026-92602

High · published September 16, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-16T21:18Z
References (6)
https://github.com/TDuckCloud/tduck-survey-form · [email protected]https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47 · [email protected]https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100 · [email protected]https://github.com/TDuckCloud/tduck-survey-form/issues/40 · [email protected]https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url · [email protected]https://github.com/TDuckCloud/tduck-survey-form/issues/40 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 16:03Z
    TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
    cvelistv5