PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110620 formbricks CVE debrief

CVE-2026-110620 is a medium-severity vulnerability in Formbricks before version 4.9.0, allowing authenticated owners or managers of any organization to bypass authorization in server actions like resetSurveyAction and updateSegmentAction. This CVE record was published on 2026-10-14T14:16:57.917Z and has not been modified since then. The vulnerability is caused by a lack of proper authorization checks in server actions, which fail to verify resource ownership against the supplied organizationId. Defenders responsible for Formbricks instances should assess exposure and prioritize upgrading to version 4.9.0 or later.

Vendor
formbricks
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for Formbricks instances should assess exposure and prioritize upgrading to version 4.9.0 or later. This includes IT administrators, security teams, and developers who use Formbricks in their environments. Additionally, security teams should review server actions for proper authorization and implement compensating controls for exposed systems.

Why it matters

CVE-2026-110620 is a medium-severity vulnerability in Formbricks before version 4.9.0, allowing authenticated owners or managers of any organization to bypass authorization in server actions. Defenders responsible for Formbricks instances should assess exposure and prioritize upgrading to version 4.9.0 or later.

  • Potential unauthorized modification of survey responses
  • Potential unauthorized modification of segments and quotas
  • Potential unauthorized alteration of pending invitations

Technical summary

The vulnerability is caused by a lack of proper authorization checks in server actions, such as resetSurveyAction and updateSegmentAction, which fail to verify resource ownership against the supplied organizationId. This allows authenticated owners or managers of any organization to bypass authorization and perform actions on resources they do not own. The affected product is Formbricks, a survey and form builder tool. The vulnerability has a medium severity score of 6.1 and is classified as an authorization bypass vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Formbricks instances and upgrading to version 4.9.0 or later.

Recommended defensive actions

  • Verify exposure of Formbricks instances
  • Upgrade to version 4.9.0 or later
  • Review server actions for proper authorization
  • Implement compensating controls for exposed systems
  • Monitor relevant logs for exposed assets
  • Track exceptions and retest remediated assets
  • Review asset inventory for affected systems

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and patches. The vulnerability allows authenticated owners or managers of any organization to pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations. There are no known exploits or reports of this vulnerability being used in attacks. However, defenders should verify exposure of Formbricks

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110620 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110620

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110620 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110620

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110620.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/formbricks/formbricks/issues/7326

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/formbricks/formbricks/releases/tag/4.9.0

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.