formbricks vulnerabilities
CVEs whose affected-version data names the formbricks package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110620Medium· 6.8Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or m…
▾ Sunlitformbricks · formbricksEPSS 0.56%via NVD
CVE-2026-105090Medium· 5.1PoCFormbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Cu…
▾ TwilightFormbricks · FormbricksEPSS 0.33%via NVD