Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: formbricks Clear all filters
TI-2026-74114 CVE-2026-110620 · GHSA-pv8w-jf7c-cvgp

Cross-organization IDOR in Formbricks server actions via organizationId

Priority LOW 28

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00558 Published 2026-10-14 Fixed in 4.9.0 CWE-639
TI-2026-67396 CVE-2026-105090 · GHSA-q9hg-xqvp-x2xv

Incorrect authorization in Formbricks

Priority MEDIUM 56

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00334 Published 2026-10-03 Fixed in 5.4.4, 6.0.1 CWE-863