CVE-2026-14792

Executive Summary

CVE-2026-14792 is a critical improper access control vulnerability discovered in Formbricks 5.0.0, specifically within the Survey Handler component. The flaw resides in the file apps/web/modules/survey/link/actions.ts, allowing remote attackers to bypass authorization checks and access or manipulate survey data without proper authentication. This vulnerability can be exploited remotely without user interaction, posing a significant risk to data confidentiality and integrity. The vendor has released a fix in version 5.1.0-rc.1, and a specific patch commit (af6023b5ac3b030ffcea24fac799f76f3e3512c6) is available. No public proof-of-concept exploits have been identified at this time.

Supply Chain & Package Security

Formbricks is an open-source survey platform distributed via npm and GitHub. Organizations using Formbricks should verify their dependency versions and ensure they are not using the vulnerable 5.0.0 release. The package is commonly integrated into Node.js applications, and supply chain attacks could leverage this vulnerability if the package is compromised. Always validate package integrity using checksums and signed commits.

CVSS Breakdown & Threat Level

While the official CVSS vector is not provided, based on the description (remote exploitation, improper access controls), a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Potential access to survey data.
• Integrity (I): High (H) – Potential modification of survey data.
• Availability (A): Low (L) – Could disrupt survey functionality.

Estimated CVSS Score: 9.1 (Critical)

Threat Level: Critical – Remote exploitation without authentication, high impact on data.

Deep Dive & Mechanics

The vulnerability exists in the Survey Handler's link action logic. The file apps/web/modules/survey/link/actions.ts likely handles operations related to survey links (e.g., sharing, accessing, or modifying surveys via unique URLs). The improper access control means that the system fails to verify whether the requesting user has the necessary permissions to perform the action. This could allow an attacker to:

• Access survey responses without authorization.
• Modify survey configurations or questions.
• Delete surveys or responses.
• Escalate privileges within the application.

The attack is performed via HTTP requests to the vulnerable endpoint, likely by manipulating parameters or session tokens. The lack of proper authorization checks in the server-side code allows these requests to succeed.

Vulnerable vs. Patched Code

The patch commit af6023b5ac3b030ffcea24fac799f76f3e3512c6 addresses the issue by adding authorization checks before processing survey link actions.

Vulnerable Code (5.0.0):

// apps/web/modules/survey/link/actions.ts
export async function handleSurveyLinkAction(surveyId: string, action: string) {
  // No authorization check
  const survey = await getSurvey(surveyId);
  // Process action without verifying user permissions
  return processAction(survey, action);
}

Patched Code (5.1.0-rc.1):

// apps/web/modules/survey/link/actions.ts
export async function handleSurveyLinkAction(surveyId: string, action: string, userId: string) {
  // Authorization check added
  const survey = await getSurvey(surveyId);
  if (!survey || !survey.isPublic && !(await isUserAuthorized(userId, surveyId))) {
    throw new Error("Unauthorized");
  }
  // Process action only if authorized
  return processAction(survey, action);
}

The key difference is the addition of the isUserAuthorized check, which ensures that only authenticated users with proper permissions can access non-public surveys.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Formbricks 5.0.0.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/survey/link/action).
2. Craft a request with a target survey ID and desired action.
3. Send the request without any authentication headers.
4. Observe unauthorized access to survey data.

Example Request (using curl):

curl -X POST "http://target.com/api/survey/link/action" \
  -H "Content-Type: application/json" \
  -d '{"surveyId": "target-survey-id", "action": "getResponses"}'

Expected Output: The server returns survey responses without requiring authentication.

Blue Team

Detection:

• Monitor for requests to /api/survey/link/action without valid session tokens.
• Look for unusual patterns in survey access logs (e.g., multiple surveys accessed by the same IP).
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to version 5.1.0-rc.1 or apply the patch.
• Implement network segmentation to limit access to the Formbricks API.
• Enable logging and alerting for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /api/survey/link/action without authentication headers.
  • Repeated requests to multiple survey IDs from a single IP.
  • Unusual response sizes indicating bulk data exfiltration.

• File IOCs:

  • Modified survey data in the database.
  • Unexpected survey deletions or changes.

• Log IOCs:

  • Log entries showing Unauthorized errors after patch, or successful access without authentication before patch.
  • Access logs with missing user IDs for survey actions.

Detection Engineering

YARA Rule

rule CVE_2026_14792_Formbricks_Access_Control {
  meta:
    description = "Detects vulnerable code pattern in Formbricks 5.0.0"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-14792"
  strings:
    $vuln_func = "handleSurveyLinkAction" ascii wide nocase
    $no_auth = "processAction" ascii wide nocase
  condition:
    $vuln_func and $no_auth and #vuln_func < 2
}

Sigma Rule

title: CVE-2026-14792 - Formbricks Unauthorized Survey Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit improper access controls in Formbricks survey link actions
author: Valters IT
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/api/survey/link/action'
    sc-status: 200
  filter:
    cs-username: '.*'  # Presence of username indicates authentication
  condition: selection and not filter
falsepositives:
  - Legitimate authenticated requests
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2026-14792 - Formbricks Unauthorized Survey Access Attempt";
  flow:to_server,established;
  content:"POST"; http_method;
  content:"/api/survey/link/action"; http_uri;
  pcre:"/^User-Agent\x3a\s[^\r\n]*$/H";  # No authentication header
  sid:1000001;
  rev:1;
  reference:cve,2026-14792;
  classtype:attempted-recon;
  priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Formbricks to version 5.1.0-rc.1 or later.
2. If immediate upgrade is not possible, apply the patch commit af6023b5ac3b030ffcea24fac799f76f3e3512c6 manually.
3. Review and restrict network access to the Formbricks API endpoints.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block unauthorized API requests.
• Conduct regular security audits of custom code and dependencies.
• Enable comprehensive logging and monitoring for all API endpoints.
• Follow the principle of least privilege for all user roles.

Validation:

• After patching, verify that unauthenticated requests to /api/survey/link/action return a 401 or 403 status code.
• Test with both authenticated and unauthenticated sessions to ensure proper access control.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert