CVE-2026-14792: Formbricks Auth Bypass Vulnerability

CVE-2026-14792 Overview

CVE-2026-14792 is an improper access control vulnerability in Formbricks 5.0.0. The flaw resides in the Survey Handler component, specifically in apps/web/modules/survey/link/actions.ts. Attackers can exploit the issue remotely over the network without authentication or user interaction. The root weakness is classified under [CWE-266: Incorrect Privilege Assignment]. According to the upstream patch, the affected actions isSurveyResponsePresentAction and validateSurveyPinAction lacked rate limiting, enabling email-enumeration and PIN brute-force attacks against link surveys. Upgrading to version 5.1.0-rc.1 resolves the issue via commit af6023b5ac3b030ffcea24fac799f76f3e3512c6.

Critical Impact
Unauthenticated remote attackers can enumerate registered survey respondents and brute-force survey PIN protection, undermining confidentiality controls on gated surveys.

Affected Products

Formbricks 5.0.0
Formbricks Survey Handler component (apps/web/modules/survey/link/actions.ts)
Deployments running Formbricks prior to 5.1.0-rc.1

Discovery Timeline

2026-07-06 - CVE-2026-14792 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-14792

Vulnerability Analysis

The vulnerability affects two server actions exposed by the Formbricks Survey Handler: isSurveyResponsePresentAction and validateSurveyPinAction. Both actions were reachable without an authenticated session and without any per-IP throttling. Because isSurveyResponsePresentAction returns a deterministic response indicating whether an email address has already submitted a survey, the endpoint functions as an oracle for user enumeration. Similarly, validateSurveyPinAction accepts arbitrary PIN guesses against protected surveys, enabling brute-force attempts at machine speed. The Formbricks maintainers addressed the flaw by wiring both actions into the existing applyIPRateLimit pipeline with a ceiling of 10 requests per minute per source IP.

Root Cause

The root cause is a missing authorization control in the form of absent rate limiting on privileged verification actions [CWE-266]. The action handlers trusted request volume implicitly and did not restrict repeated invocations, so security-relevant boolean responses could be sampled at scale.

Attack Vector

Exploitation is remote and requires only network access to a Formbricks link-survey endpoint. An attacker submits a large number of requests iterating over candidate email addresses or PIN values, then observes the action response to determine validity. No credentials or user interaction are required.

typescript

// Patch: apps/web/modules/core/rate-limit/rate-limit-configs.ts
       allowedPerInterval: 10,
       namespace: "action:send-link-survey-email",
     }, // 10 per hour
+    isSurveyResponsePresent: {
+      interval: 60,
+      allowedPerInterval: 10,
+      namespace: "action:survey-response-present",
+    }, // 10 per minute — prevents email-enumeration oracle
+    validateSurveyPin: {
+      interval: 60,
+      allowedPerInterval: 10,
+      namespace: "action:validate-survey-pin",
+    }, // 10 per minute — prevents brute-force PIN guessing
     licenseRecheck: { interval: 60, allowedPerInterval: 5, namespace: "action:license-recheck" }, // 5 per minute

Source: GitHub Commit af6023b5

typescript

// Patch: apps/web/modules/survey/link/actions.ts
 export const validateSurveyPinAction = actionClient
   .inputSchema(ZValidateSurveyPinAction)
   .action(async ({ parsedInput }) => {
+    await applyIPRateLimit(rateLimitConfigs.actions.validateSurveyPin);
+
     // Get survey data which includes pin information
     const survey = await getSurveyWithMetadata(parsedInput.surveyId);
     if (!survey) {

Source: GitHub Commit af6023b5

Detection Methods for CVE-2026-14792

Indicators of Compromise

High-frequency POST requests from a single source IP to Formbricks server-action endpoints backing isSurveyResponsePresentAction or validateSurveyPinAction.
Sequential or dictionary-ordered email values submitted to the survey response presence check.
Repeated PIN validation attempts against the same surveyId with varying numeric input.

Detection Strategies

Correlate web access logs for bursts of Next.js server-action calls targeting /modules/survey/link handlers.
Alert when a single IP exceeds the newly enforced 10-requests-per-minute threshold on either action namespace.
Baseline legitimate survey traffic patterns and flag deviations in request cardinality per email or per surveyId.

Monitoring Recommendations

Forward Formbricks application and reverse-proxy logs to a centralized analytics platform for retention and query.
Monitor rate-limit rejection metrics emitted by applyIPRateLimit after patching to identify ongoing attack attempts.
Track outbound response payload patterns that could confirm successful enumeration, such as consistent true/false responses across email lists.

How to Mitigate CVE-2026-14792

Immediate Actions Required

Upgrade Formbricks to version 5.1.0-rc.1 or later, which includes commit af6023b5ac3b030ffcea24fac799f76f3e3512c6.
Review historical access logs for evidence of enumeration or PIN brute-force activity prior to the upgrade.
Rotate PINs on any surveys that may have been exposed to sustained probing.

Patch Information

The fix is delivered in the Formbricks 5.1.0-rc.1 release and applied via pull request #8094. The patch adds applyIPRateLimit invocations to both isSurveyResponsePresentAction and validateSurveyPinAction, capped at 10 requests per minute per IP address. Additional detail is available on the VulDB entry for CVE-2026-14792.

Workarounds

Place Formbricks behind a reverse proxy or web application firewall and enforce request-rate ceilings on the affected action paths.
Restrict access to link-survey endpoints by IP allow-list where surveys are used within known corporate networks.
Temporarily disable PIN-protected surveys or reissue them with high-entropy PINs until the upgrade is deployed.

bash

# Example: NGINX rate limit for Formbricks server actions until patch is applied
limit_req_zone $binary_remote_addr zone=formbricks_actions:10m rate=10r/m;

server {
    location /modules/survey/link/ {
        limit_req zone=formbricks_actions burst=5 nodelay;
        proxy_pass http://formbricks_upstream;
    }
}