Formbricks 5.0.0 contains a flaw in the survey handler, enabling improper access control that allows an attacker to trigger survey actions without proper authorization. The weakness, rooted in CWE‑284 and credential use (CWE‑266), permits the remote execution of survey actions that should be restricted to authenticated users or specific roles. When exploited, an attacker could read, modify, or delete survey data, potentially compromising confidentiality and integrity of user responses.

The vulnerability resides in the file apps/web/modules/survey/link/actions.ts of Formbricks 5.0.0. All installations using Formbricks versions prior to 5.1.0‑rc.1 are affected; the patch introduced in 5.1.0‑rc.1 resolves the issue.

The CVSS score of 6.9 places this vulnerability in the medium severity bracket, and the EPSS score of less than 1% indicates a low probability that it will be actively exploited in the immediate future. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector involves access to the /survey-link/actions endpoint over HTTP/HTTPS, where an unauthenticated or improperly authenticated request could trigger the vulnerability. The weakness emerges from inadequate customer authentication checks and improper control over component interactions within the Survey Handler.