Is CVE-2026-14792 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14792 being exploited in the wild.

How severe is CVE-2026-14792?

Medium severity, with a CVSS score of 6.5, published 6 July 2026.

Is there a fix for CVE-2026-14792?

A patch was published on 2026-05-27: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14792 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-14792?

Check whether you run Formbricks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14792: Formbricks improper access control in Survey Handler

CVE-2026-14792 · Severity: medium · CVSS 6.5 · Published 2026-07-06

Formbricks, an open-source survey platform, contains a security flaw in how it handles survey responses and PIN validation. This vulnerability allows unauthorized individuals to repeatedly test email addresses to see who has responded to a survey or to attempt to guess survey PINs using automated tools. This could lead to the exposure of participant activity or unauthorized access to protected surveys.

Technologies: Formbricks. Vendors: Formbricks.

Quick answers

Is CVE-2026-14792 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14792 being exploited in the wild.
How severe is CVE-2026-14792?: Medium severity, with a CVSS score of 6.5, published 6 July 2026.
Which products and versions are affected?: Formbricks 5.0.0.
Is there a fix for CVE-2026-14792?: A patch was published on 2026-05-27: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14792 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-14792?: Check whether you run Formbricks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Formbricks 5.0.0 within `apps/web/modules/survey/link/actions.ts` stems from missing rate limits and server-side validation in the `isSurveyResponsePresentAction` and `validateSurveyPinAction` functions. An unauthenticated remote attacker can exploit this to perform email-enumeration oracle attacks, determining if specific users have responded to a survey even when the 'single response per email' feature is disabled. Additionally, the lack of rate limiting on PIN validation allows for automated brute-force attempts against protected surveys. The issue is addressed in version 5.1.0-rc.1 by implementing IP-based rate limiting (10 requests per minute) and enforcing server-side feature flag checks.

Affected products

Formbricks Formbricks 5.0.0

Timeline

2026-05-21: other: Fix submitted via pull request 8094
2026-05-27: patched: Fix merged into main branch
2026-06-09: advisory: Release 5.1.0-rc.1 published
2026-07-06: disclosed: CVE-2026-14792 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.