Junglewise Threat Intelligence

CVE-2026-14792: Formbricks improper access control in Survey Handler

CVE-2026-14792 · Severity: medium · CVSS 6.5 · Published 2026-07-06

Executive brief

Formbricks, an open-source survey platform, contains a security flaw in how it handles survey responses and PIN validation. This vulnerability allows unauthorized individuals to repeatedly test email addresses to see who has responded to a survey or to attempt to guess survey PINs using automated tools. This could lead to the exposure of participant activity or unauthorized access to protected surveys.

Technical details

A vulnerability in Formbricks 5.0.0 within `apps/web/modules/survey/link/actions.ts` stems from missing rate limits and server-side validation in the `isSurveyResponsePresentAction` and `validateSurveyPinAction` functions. An unauthenticated remote attacker can exploit this to perform email-enumeration oracle attacks, determining if specific users have responded to a survey even when the 'single response per email' feature is disabled. Additionally, the lack of rate limiting on PIN validation allows for automated brute-force attempts against protected surveys. The issue is addressed in version 5.1.0-rc.1 by implementing IP-based rate limiting (10 requests per minute) and enforcing server-side feature flag checks.

Affected products

  • Formbricks Formbricks 5.0.0

Timeline

  • 2026-05-21: other: Fix submitted via pull request 8094
  • 2026-05-27: patched: Fix merged into main branch
  • 2026-06-09: advisory: Release 5.1.0-rc.1 published
  • 2026-07-06: disclosed: CVE-2026-14792 published

References