CVE-2026-110620 json
Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
published 2026-10-14 25 d ago modified 2026-10-26 13 d ago also EUVD-2026-101248
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
Patch / fix
- formbricks formbricks 4.9.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 d ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
| CNA | 4.0 | 6.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- formbricks formbricks
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f
patch
-
github.com
/formbricks/formbricks/issues/7326
issue-tracking
-
github.com
/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(
technical-description
-
github.com
/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50
technical-description
-
github.com
/formbricks/formbricks/releases/tag/4.9.0
release-notes
-
vulncheck.com
/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid
third-party-advisory
Sources
- CVE List CVE-2026-110620
- NVD CVE-2026-110620
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.