EUVD-2026-41803
GHSA-g57h-53rr-6677
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated bypass (AV:N, PR:N) with no interaction needed; impact limited to low integrity and availability writes, no confidentiality breach, scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. Upgrading to version 5.1.0-rc.1 will fix this issue. The identifier of the patch is af6023b5ac3b030ffcea24fac799f76f3e3512c6. You should upgrade the affected component.
AnalysisAI
Improper access control in Formbricks 5.0.0 allows remote unauthenticated attackers to bypass authorization checks in the link survey handler, enabling unauthorized manipulation of survey data with limited integrity and availability impact. The flaw resides in the Survey Handler component (apps/web/modules/survey/link/actions.ts) and is tagged as an authentication bypass, confirmed by the CVSS 4.0 PR:N metric indicating no credentials are required. No active exploitation has been confirmed and no public exploit code has been identified; a patch is available as release candidate 5.1.0-rc.1.
Technical ContextAI
Formbricks is an open-source, TypeScript-based survey and form management platform built on Next.js. The vulnerable component is the server-side action handler for link-based (public-facing) surveys located at apps/web/modules/survey/link/actions.ts. CWE-284 (Improper Access Control) identifies the root cause as a failure to adequately enforce authorization gates on survey-related operations accessible via the link survey pathway. The CPE string cpe:2.3:a:n/a:formbricks:*:*:*:*:*:*:*:* notes the vendor field as 'n/a', reflecting community-reported classification rather than an official vendor CPE assignment. The affected function within the handler was permitting unauthorized state changes or interactions with survey objects that should be gated behind ownership or role checks.
RemediationAI
Upgrade to Formbricks 5.1.0-rc.1, which contains patch commit af6023b5ac3b030ffcea24fac799f76f3e3512c6 addressing the access control flaw (GitHub PR: https://github.com/formbricks/formbricks/pull/8094; release tag: https://github.com/formbricks/formbricks/releases/tag/5.1.0-rc.1). Note that 5.1.0-rc.1 is a release candidate - organizations requiring production-stable builds should monitor the Formbricks GitHub repository for a stable 5.1.0 tag. As a compensating control pending upgrade, network-layer restrictions limiting access to the link survey endpoint (e.g., IP allowlisting or WAF rules targeting the /survey/link path) can reduce exposure, with the trade-off of breaking legitimate anonymous survey respondent access. Disabling public link surveys entirely via application configuration would eliminate the attack surface but may disrupt core functionality.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today