CVE-2026-110620
Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
| CWE | CWE-639 |
| Vendor | formbricks |
| Product | formbricks |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for formbricks formbricks
Be the first to know when new medium vulnerabilities affecting formbricks formbricks are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
formbricks / formbricks
0 < 4.9.0
References
github.com: https://github.com/formbricks/formbricks/issues/7326 github.com: https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts#L65-L95 github.com: https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50 github.com: https://github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f github.com: https://github.com/formbricks/formbricks/releases/tag/4.9.0 vulncheck.com: https://www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid
Credits
lighthousekeeper1212 🔍 leediay153 from Viettel Post