CVE-2026-105090

MediumCVSS 5.1

Published: 03/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The Custom Head Scripts feature did not enforce the Manage permission boundary, allowing members with readWrite permission to configure scripts that execute in the session of higher-privileged users.

Risk Assessment

Risk of arbitrary JavaScript execution in the session of administrators or other privileged users, potentially leading to account takeover or privilege escalation.

Recommendation

Update Formbricks to version 5.4.4 or 6.0.1 (or later). Conduct a privilege audit and ensure only users with the Manage role can modify Custom Head Scripts.

Other vulnerabilities in Formbricks

CVE-2026-14792Medium
A security vulnerability was found in Formbricks 5.0.0 in the Survey Handler component (file apps/web/modules/survey/link/actions.ts). Manipulation leads to improper access controls, allowing remote exploitation.

Original NVD description (English source)

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS