Cross-organization IDOR in Formbricks server actions via organizationId
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Formbricks before 4.9.0 contains an authorization bypass in server actions such as resetSurveyAction and updateSegmentAction, which do not verify that a resource belongs to the supplied organizationId. An authenticated owner or manager of any organization can pair their own organization identifier with resource IDs from another organization to delete survey responses, modify segments and quotas, or alter pending invitations. The flaw is classified as CWE-639, an authorization bypass through a user-controlled key.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| formbricks | formbricks | before 4.9.0 | 4.9.0 | Patch available | CNA |
- formbricks Vendorformbricks Affected before 4.9.0 Fixed in 4.9.0 Patch available CNA
Remediation
Update Formbricks to version 4.9.0 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA formbricks (formbricks) Fixed in 4.9.0
Timeline
- 2026-10-14 Threatist record created from CVE-2026-110620
- 2026-10-14 Alias added: GHSA-pv8w-jf7c-cvgp
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-26 CISA SSVC decision points changed
References
Other 4
- https://github.com/formbricks/formbricks/issues/7326
- https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts#L65-L95
- https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50
- Formbricks 4.9.0 Release Notes
More formbricks vulnerabilities
- TI-2025-37322 Formbricks missing JWT signature verification CVSS 3.1CRITICAL 9.4
- TI-2026-67396 Incorrect authorization in Formbricks CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-110620 · CVE Program
- CVE-2026-110620 · NVD
- FIRST EPSS
- GHSA-pv8w-jf7c-cvgp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences