CVE-2026-110620
MediumCVSS 6.8Summary
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
Risk Assessment
An attacker with owner or manager privileges in any organization can modify or delete data of other organizations, leading to confidentiality and integrity breaches.
Recommendation
Update Formbricks to version 4.9.0 or later, which fixes this vulnerability.
Other vulnerabilities in Formbricks
See all- CVE-2026-105090Medium
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The Custom Head Scripts feature did not enforce the Manage permission boundary, allowing members with readWrite permission to configure scripts that execute in the session of higher-privileged users.
- CVE-2026-14792Medium
A security vulnerability was found in Formbricks 5.0.0 in the Survey Handler component (file apps/web/modules/survey/link/actions.ts). Manipulation leads to improper access controls, allowing remote exploitation.
Original NVD description (English source)
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS