Refine your search
3 vulnerabilities found for by Formbricks
CVE-2026-110620 (GCVE-0-2026-110620)
Vulnerability from cvelistv5
Published
2026-10-14 14:16
Modified
2026-10-26 16:12
Severity ?
6.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
VLAI Severity ?
EPSS score ?
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| formbricks | formbricks |
Version: 0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T16:12:07.115703Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:12:38.788Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/formbricks/formbricks",
"defaultStatus": "unaffected",
"product": "formbricks",
"repo": "https://github.com/formbricks/formbricks",
"vendor": "formbricks",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:57.917Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/formbricks/formbricks/issues/7326"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts#L65-L95"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50"
},
{
"tags": [
"patch"
],
"url": "https://github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f"
},
{
"name": "Formbricks 4.9.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/formbricks/formbricks/releases/tag/4.9.0"
},
{
"name": "VulnCheck Advisory: Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid"
}
],
"title": "Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110620",
"datePublished": "2026-10-14T14:16:57.917Z",
"dateReserved": "2026-10-14T13:07:26.834Z",
"dateUpdated": "2026-10-26T16:12:38.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105090 (GCVE-0-2026-105090)
Vulnerability from cvelistv5
Published
2026-10-03 01:59
Modified
2026-10-05 17:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Formbricks | Formbricks |
Version: 0 ≤ Version: 6.0.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105090",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T17:04:02.074755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T17:05:12.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/formbricks/formbricks",
"defaultStatus": "unaffected",
"product": "Formbricks",
"vendor": "Formbricks",
"versions": [
{
"lessThan": "5.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.0.1",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T01:59:10.911Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "Formbricks release 6.0.1 (fix)",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/formbricks/formbricks/releases/tag/6.0.1"
},
{
"name": "Formbricks release 5.4.4 (fix, backport)",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/formbricks/formbricks/releases/tag/5.4.4"
},
{
"name": "PR #9432 - require Manage access to change survey custom head scripts",
"tags": [
"patch"
],
"url": "https://github.com/formbricks/formbricks/pull/9432"
},
{
"tags": [
"technical-description"
],
"url": "https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-105090",
"datePublished": "2026-10-03T01:59:10.911Z",
"dateReserved": "2026-10-03T01:59:10.142Z",
"dateUpdated": "2026-10-05T17:05:12.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59934 (GCVE-0-2025-59934)
Vulnerability from cvelistv5
Published
2025-09-26 23:03
Modified
2025-09-29 14:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| formbricks | formbricks |
Version: < 4.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59934",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-29T14:59:35.884199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-29T14:59:51.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "formbricks",
"vendor": "formbricks",
"versions": [
{
"status": "affected",
"version": "\u003c 4.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token\u2019s signature, expiration, issuer, or audience. If an attacker learns the victim\u2019s actual user.id, they can craft an arbitrary JWT with an alg: \"none\" header and use it to authenticate and reset the victim\u2019s password. This issue has been patched in version 4.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-26T23:03:30.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/formbricks/formbricks/security/advisories/GHSA-7229-q9pv-j6p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/formbricks/formbricks/security/advisories/GHSA-7229-q9pv-j6p4"
},
{
"name": "https://github.com/formbricks/formbricks/pull/6596",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/formbricks/formbricks/pull/6596"
},
{
"name": "https://github.com/formbricks/formbricks/commit/eb1349f205189d5b2d4a95ec42245ca98cf68c82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/formbricks/formbricks/commit/eb1349f205189d5b2d4a95ec42245ca98cf68c82"
},
{
"name": "https://github.com/formbricks/formbricks/blob/843110b0d6c37b5c0da54291616f84c91c55c4fc/apps/web/lib/jwt.ts#L114-L117",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/formbricks/formbricks/blob/843110b0d6c37b5c0da54291616f84c91c55c4fc/apps/web/lib/jwt.ts#L114-L117"
}
],
"source": {
"advisory": "GHSA-7229-q9pv-j6p4",
"discovery": "UNKNOWN"
},
"title": "Formbricks missing JWT signature verification"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59934",
"datePublished": "2025-09-26T23:03:30.995Z",
"dateReserved": "2025-09-23T14:33:49.505Z",
"dateUpdated": "2025-09-29T14:59:51.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}