CVE-2026-14792: Formbricks 5.0.0 Improper Access Control Vulnerability (CVSS 6.5)

Technical summary

CVE-2026-14792 is a medium-severity improper access control vulnerability (CVSS 3.1 score 6.5) affecting the Survey Handler component in Formbricks. The flaw resides in apps/web/modules/survey/link/actions.ts and stems from insufficient authorization checks, as indicated by the CWE-266 (Improper Privilege Management) and CWE-284 (Improper Access Control By User in User Interface) classifications. The vulnerability is remotely exploitable without authentication or user interaction, operating on the network attack surface with low attack complexity.

Business impact

Organizations deploying Formbricks 5.0.0 for survey distribution and data collection face integrity and availability risks. An attacker could modify survey responses, alter survey logic, or degrade service availability. For enterprises relying on Formbricks for customer feedback, market research, or internal assessments, this could compromise data accuracy and customer trust. The lack of authentication requirement increases the attack surface significantly—any network-exposed instance is potentially at risk.

Affected systems

Formbricks 5.0.0 is confirmed vulnerable. Version 5.1.0-rc.1 and later contain the fix (commit af6023b5ac3b030ffcea24fac799f76f3e3512c6). Organizations using version 5.0.0 should assume they are affected if the survey link handler is exposed to untrusted networks. Verify your deployment version and check whether apps/web/modules/survey/link/actions.ts has been updated.

Exploitability

This vulnerability is exploitable remotely without authentication, user interaction, or special privileges. An attacker only needs network connectivity to the affected Formbricks instance. The low attack complexity means no special techniques or conditions are required to trigger the flaw. However, this vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not yet been widely documented. Organizations should not rely on absence from KEV as grounds for deferring remediation.

Remediation

Immediately upgrade Formbricks to version 5.1.0-rc.1 or later. If a stable (non-RC) release is available beyond 5.1.0-rc.1, prioritize that. Apply the patch containing commit af6023b5ac3b030ffcea24fac799f76f3e3512c6. As an interim mitigation, restrict network access to the Formbricks instance via firewall or reverse proxy to limit exposure to trusted users and IP ranges. However, this is not a substitute for patching.

Patch guidance

The fix is available in version 5.1.0-rc.1 and later. Consult the official Formbricks release notes and repository to confirm the stable release schedule. If only an RC version is available in your environment, evaluate the stability and maturity of that RC release before deploying to production. Given the MEDIUM severity and remote exploitability, patch deployment should be prioritized within your standard change management window—typically within 2–4 weeks, but sooner if the instance is internet-facing. Test the upgrade in a staging environment to confirm survey functionality and existing data integrity.

Detection guidance

Monitor access logs to apps/web/modules/survey/link/actions.ts for unauthorized or anomalous requests. Look for patterns indicating data manipulation: unexpected changes to survey metadata, responses, or link configurations from unknown IP addresses or without corresponding user actions. Implement logging around access control decisions in the survey handler. If available, deploy a web application firewall (WAF) rule to inspect requests to survey link endpoints for suspicious payloads or parameter tampering. Correlate logs with your identity and access management (IAM) system to identify sessions that should not have privilege to modify surveys.

Why prioritize this

This vulnerability merits medium priority based on its CVSS 6.5 score, remote exploitability without authentication, and direct impact on data integrity and availability. While not yet exploited in the wild (per KEV), the lack of authentication requirement means every exposed Formbricks 5.0.0 instance is a target. Prioritization should increase if your instance is internet-facing, used for sensitive data collection, or central to business processes. For internal-only deployments with restricted network access, remediation can follow standard patching schedules.

Risk score, explained

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects a network-adjacent attack that requires no privileges or user interaction but causes limited integrity and availability damage. The score of 6.5 is elevated by the absence of authentication and the low attack complexity, but constrained by the limited scope of impact (integrity and availability only; no confidentiality breach). Organizations with strict data integrity or availability requirements should treat this as HIGH priority despite the medium score.

Frequently asked questions