CVE-2026-110620: Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Formbricksto a version that resolves this vulnerability.Fixed in 4.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Formbricks user who is an owner or manager of any organization can exploit it. They do not need membership in the victim organization if they know or can supply identifiers for victim resources.
What actions could an attacker perform?
An attacker can delete survey responses, modify segments and quotas, and alter pending invitations belonging to another organization. The reported vulnerable server actions include resetSurveyAction and updateSegmentAction.
Are unauthenticated users affected?
The provided information describes exploitation by authenticated organization owners or managers. It does not indicate that unauthenticated users can exploit the issue.
What version resolves the issue?
Formbricks versions before 4.9.0 are affected. Updating to 4.9.0 or later addresses the affected version range described here.