Read the docs

formbricks

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

formbricks records in CISA KEV

No formbricks vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-67396 CVE-2026-105090 · GHSA-q9hg-xqvp-x2xv

Incorrect authorization in Formbricks

Priority MEDIUM 56

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00334 Published 2026-10-03 Fixed in 5.4.4, 6.0.1 CWE-863
TI-2026-74114 CVE-2026-110620 · GHSA-pv8w-jf7c-cvgp

Cross-organization IDOR in Formbricks server actions via organizationId

Priority LOW 28

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00558 Published 2026-10-14 Fixed in 4.9.0 CWE-639
Open these records in search →