CVE-2026-105090
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The Custom Head Scripts feature did not enforce the Manage permission boundary, allowing members with readWrite permission to configure scripts that execute in the session of higher-privileged users.
Risk Assessment
Risk of arbitrary JavaScript execution in the session of administrators or other privileged users, potentially leading to account takeover or privilege escalation.
Recommendation
Update Formbricks to version 5.4.4 or 6.0.1 (or later). Conduct a privilege audit and ensure only users with the Manage role can modify Custom Head Scripts.
Other vulnerabilities in Formbricks
See all- CVE-2026-110620Medium
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
- CVE-2026-14792Medium
A security vulnerability was found in Formbricks 5.0.0 in the Survey Handler component (file apps/web/modules/survey/link/actions.ts). Manipulation leads to improper access controls, allowing remote exploitation.
Original NVD description (English source)
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS