# CVE-2026-14792: Formbricks improper access control in Survey Handler

Source: https://junglewise.ai/threats/cve-2026-14792-formbricks-improper-access-control-in-survey-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-14792 · Severity: medium · CVSS 6.5 · Published 2026-07-06

Formbricks, an open-source survey platform, contains a security flaw in how it handles survey responses and PIN validation. This vulnerability allows unauthorized individuals to repeatedly test email addresses to see who has responded to a survey or to attempt to guess survey PINs using automated tools. This could lead to the exposure of participant activity or unauthorized access to protected surveys.

Technologies: [Formbricks](https://junglewise.ai/threats/technologies/formbricks). Vendors: [Formbricks](https://junglewise.ai/threats/vendors/formbricks).

## Quick answers

**Is CVE-2026-14792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14792 being exploited in the wild.

**How severe is CVE-2026-14792?** Medium severity, with a CVSS score of 6.5, published 6 July 2026.

**Which products and versions are affected?** Formbricks 5.0.0.

**Is there a fix for CVE-2026-14792?** A patch was published on 2026-05-27: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14792 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14792?** Check whether you run Formbricks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Formbricks 5.0.0 within `apps/web/modules/survey/link/actions.ts` stems from missing rate limits and server-side validation in the `isSurveyResponsePresentAction` and `validateSurveyPinAction` functions. An unauthenticated remote attacker can exploit this to perform email-enumeration oracle attacks, determining if specific users have responded to a survey even when the 'single response per email' feature is disabled. Additionally, the lack of rate limiting on PIN validation allows for automated brute-force attempts against protected surveys. The issue is addressed in version 5.1.0-rc.1 by implementing IP-based rate limiting (10 requests per minute) and enforcing server-side feature flag checks.

## Affected products

- Formbricks Formbricks 5.0.0

## Timeline

- 2026-05-21: other: Fix submitted via pull request 8094
- 2026-05-27: patched: Fix merged into main branch
- 2026-06-09: advisory: Release 5.1.0-rc.1 published
- 2026-07-06: disclosed: CVE-2026-14792 published

## References

- [https://github.com/formbricks/formbricks/](https://github.com/formbricks/formbricks/)
- [https://github.com/formbricks/formbricks/commit/af6023b5ac3b030ffcea24fac799f76f3e3512c6](https://github.com/formbricks/formbricks/commit/af6023b5ac3b030ffcea24fac799f76f3e3512c6)
- [https://github.com/formbricks/formbricks/pull/8094](https://github.com/formbricks/formbricks/pull/8094)
- [https://github.com/formbricks/formbricks/releases/tag/5.1.0-rc.1](https://github.com/formbricks/formbricks/releases/tag/5.1.0-rc.1)
- [https://vuldb.com/cve/CVE-2026-14792](https://vuldb.com/cve/CVE-2026-14792)
- [https://vuldb.com/submit/850791](https://vuldb.com/submit/850791)
- [https://vuldb.com/vuln/376386](https://vuldb.com/vuln/376386)

## Related threats

- [Formbricks authorization bypass in server actions](https://junglewise.ai/threats/cve-2026-110620-formbricks-before-4-9-0-contains-an-authorization-bypass)
- [Formbricks stored XSS in survey Custom Head Scripts](https://junglewise.ai/threats/cve-2026-105090-formbricks-before-5-4-4-and-6-before-6-0-1-allows-stored-xss-the)