Vulnerability · Published Jul 6, 2026 · Assigned by VulDB
CVE-2026-14792Formbricks Survey actions.ts access control
Medium 6.5
In plain English
A medium-severity improper access control in Formbricks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. Upgrading to version 5.1.0-rc.1 will fix this issue. The identifier of the patch is af6023b5ac3b030ffcea24fac799f76f3e3512c6. You should upgrade the affected component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Formbricks | 5.0.0 |
Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
References
- VDB-376386 | Formbricks Survey actions.ts access control vdb-entry
- VDB-376386 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-14792 | CVE Analysis and Report third-party-advisory
- Submit #850791 | Formbricks 5.0.0 Improper Access Controls third-party-advisory
- https://github.com/formbricks/formbricks/pull/8094 issue-tracking, patch
- https://github.com/formbricks/formbricks/commit/af6023b5ac3b030ffcea24fac799f76f3e3512c6 patch
- https://github.com/formbricks/formbricks/releases/tag/5.1.0-rc.1 patch
- https://github.com/formbricks/formbricks/ product