Formbricks EUVD-2026-91874

Requires an authenticated attacker holding at least 'readWrite' permission in the target Formbricks workspace (PR:L); no Manage role is needed because the permission check was missing on the survey-level Custom Head Scripts feature. The attacker configures Custom Head Scripts on a survey, and exploitation only completes when a separate, higher-privileged user opens that affected survey (UI:P), causing the stored script to run in that victim's authenticated session. Limiting factors: the attacker must already have a valid in-workspace account, the deployment must have multiple privilege tiers sharing surveys, the victim must actively open the malicious survey, and the issue is fully remediated in 5.4.4 and 6.0.1 which re-enforce the Manage requirement.

This is a genuine but moderate-severity issue, not a high-urgency priority. The only quantitative signal provided is a CVSS 4.0 base score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - network reachable and low complexity, but gated behind PR:L (an authenticated low-privilege 'readWrite' workspace member) and UI:P (a higher-privileged user must open the affected survey). No EPSS score, no CISA KEV listing, and no verified public exploit code were supplied, so there is no evidence of active or at-scale exploitation; a vendor/researcher blog writeup (sec4check.pl) exists but is a disclosure writeup rather than confirmed weaponized POC. The impact metrics are uniformly Low (VC:L/VI:L), consistent with stored XSS running in another user's session rather than full account/system takeover. The signals are internally consistent - this is a privilege-boundary (CWE-863 incorrect authorization) flaw that enables stored XSS against collaborators, exploitable only by someone who already holds a valid account in the same workspace. Treat as a standard-cadence patch for multi-user Formbricks deployments, prioritized higher where many lower-trust members share workspaces with admins.

A workspace member who only has readWrite permission edits a survey and configures malicious Custom Head Scripts - an action that should require the Manage role but was not enforced. When a higher-privileged user (e.g., a Manage-role admin) later opens that survey in their authenticated browser session, the attacker's JavaScript executes in that session, enabling session-context actions against the victim. No public exploit code is confirmed, though a researcher disclosure writeup describes the flaw.