Formbricks CVE-2026-110620

Exploitation requires an authenticated account holding owner or manager privileges in at least one organization on the target Formbricks instance (PR:L), and the attacker must supply valid victim resource identifiers - a surveyId, segmentId, quotaId, or invitation ID belonging to another organization (reflected by AT:P). The vulnerable paths are the server actions (e.g., resetSurveyAction, updateSegmentAction) that trusted the client-supplied organizationId instead of resolving ownership from the resource. Limiting factors: this is only meaningful in multi-tenant or shared deployments where mutually untrusted organizations exist; it is not remotely exploitable by unauthenticated users; and it is fixed in version 4.9.0, so patched instances are not affected. Impact is limited to integrity/availability of responses, segments, quotas, and invitations - no data exfiltration or authentication defeat.

The vendor CVSS 4.0 score of 6.1 (Medium) is internally consistent with the described flaw: AV:N (the vulnerable server actions are reachable over the network), AC:L (no special timing or race), PR:L (the attacker must already hold an authenticated owner/manager role in some organization), AT:P (the attack requires knowledge of victim resource IDs), UI:N, and impact confined to VI:H/VA:H with VC:N - i.e., integrity and availability damage (deleting survey responses, altering segments/quotas/invitations) but no direct confidentiality breach. No EPSS score, KEV listing, or POC is present in the input, so there is no signal of active or widespread exploitation; this is a privilege/authorization issue (CWE-639 IDOR) rather than a mass-exploitable unauthenticated RCE. Real-world priority is elevated specifically for multi-tenant Formbricks deployments (hosted SaaS or shared self-hosted instances) where untrusted tenants coexist - there, any paying/invited org owner can tamper cross-organization. In single-tenant or trusted-org deployments the practical risk is low because the attacker already needs a privileged account on the same instance. Patch availability (4.9.0) makes this a straightforward remediate-and-move-on item rather than an emergency. No data signals conflict; the main caveat is the absence of EPSS/KEV/POC data, so exploitation likelihood cannot be quantified from the input.

A legitimate but malicious owner or manager of Organization B (e.g., a tenant on a shared Formbricks instance) obtains or guesses resource identifiers belonging to Organization A - such as a surveyId or segmentId. They invoke resetSurveyAction or updateSegmentAction while passing their own organizationId; because the server never verifies that the resource actually belongs to that organization, the action succeeds against the victim's data, wiping survey responses or rewriting segments and quotas. No public exploit identified at time of analysis, but the flaw is trivially reproducible from the vendor commit diff.