TI-2026-67396 Aliases CVE-2026-105090 GHSA-q9hg-xqvp-x2xv

Incorrect authorization in Formbricks

MEDIUM 56CWE-863Published 2026-10-03 · Updated 2026-10-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00334 26th percentileScored 2026-11-07

Fix Fixed Formbricks (Formbricks): 5.4.4, 6.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
formbricks	Formbricks	before 5.4.4; 6.0.0 to before 6.0.1	5.4.4, 6.0.1	Patch available	CNA

Formbricks Vendorformbricks Affected before 5.4.4; 6.0.0 to before 6.0.1 Fixed in 5.4.4, 6.0.1 Patch available CNA

Remediation

Fix · CNA Formbricks (Formbricks) Fixed in 5.4.4, 6.0.1

Timeline

2026-10-03 Threatist record created from CVE-2026-105090
2026-10-03 Alias added: GHSA-q9hg-xqvp-x2xv
2026-10-05 CISA SSVC decision points changed
2026-10-05 Priority changed: LOW → MEDIUM

References

Patch 3

Other 1

https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html

TI-2025-37322 Formbricks missing JWT signature verification CVSS 3.1CRITICAL 9.4
TI-2026-74114 Cross-organization IDOR in Formbricks server actions via organizationId CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences