CVE-2026-14792
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A security vulnerability was found in Formbricks 5.0.0 in the Survey Handler component (file apps/web/modules/survey/link/actions.ts). Manipulation leads to improper access controls, allowing remote exploitation.
Risk Assessment
An attacker can remotely gain unauthorized access to survey functionality, potentially leading to data confidentiality breaches or unauthorized actions in the system.
Recommendation
Upgrade Formbricks to version 5.1.0-rc.1 or apply the patch af6023b5ac3b030ffcea24fac799f76f3e3512c6 immediately.
Other vulnerabilities in Formbricks
See all- CVE-2026-110620Medium
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
- CVE-2026-105090Medium
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The Custom Head Scripts feature did not enforce the Manage permission boundary, allowing members with readWrite permission to configure scripts that execute in the session of higher-privileged users.
Original NVD description (English source)
A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. Upgrading to version 5.1.0-rc.1 will fix this issue. The identifier of the patch is af6023b5ac3b030ffcea24fac799f76f3e3512c6. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS