CVE-2026-105090 in Formbricks
Summary
by MITRE • 10/03/2026
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in Formbricks prior to version 5.4.4 and version 6 before 6.0.1 represents a critical failure in role-based access control that facilitates stored cross-site scripting attacks. This flaw specifically targets the Survey-level Custom Head Scripts feature, which allows administrators or authorized users to inject custom JavaScript code into the header of survey pages. The core technical deficiency lies in the enforcement mechanism for permission boundaries associated with this specific configuration option. While the system documentation explicitly restricts the ability to configure these scripts to users holding the Manage role, the underlying access control logic fails to validate this requirement during runtime operations. Consequently, any workspace member possessing only readWrite permissions is able to successfully submit and save custom head script configurations for a survey they do not have administrative rights over.
From an operational perspective, this misconfiguration creates a severe security risk by enabling privilege escalation through code execution rather than direct system access. When a lower-privileged user injects malicious JavaScript via the Custom Head Scripts feature, that payload is stored server-side and subsequently rendered in the HTML of any survey page it is attached to. Because these scripts execute within the authenticated browser session of every visitor who opens the affected survey, an attacker can target high-value targets such as system administrators or other users with elevated privileges. By crafting a script that exfiltrates cookies, session tokens, or sensitive form data, and redirecting this information to an external server controlled by the attacker, the vulnerability effectively bypasses standard authentication barriers. This transforms a simple permission oversight into a vector for comprehensive account compromise and potential lateral movement within the organization's digital infrastructure.
This incident aligns with CWE-269, which describes Improper Privilege Assignment, as the application incorrectly grants capabilities to users based on an insufficiently enforced role definition. Furthermore, it maps directly to MITRE ATT&CK technique T1059.007, JavaScript Execution, specifically within a web browser context. The stored nature of the payload also corresponds to CWE-79, Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). Unlike reflected XSS where the malicious script is part of the immediate request, this vulnerability persists in the application state, affecting all subsequent users who interact with the compromised survey. The impact extends beyond simple data theft; it undermines the integrity of the entire workspace by allowing untrusted code execution within trusted sessions.
To mitigate this risk and prevent similar occurrences, organizations must ensure that access control lists are rigorously tested against documented permission boundaries during both development and security auditing phases. For users currently running affected versions, immediate upgrading to Formbricks version 5.4.4 or later is essential to restore the intended restriction on Custom Head Scripts configuration. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any residual XSS vulnerabilities by restricting the sources from which scripts are allowed to execute. Regular penetration testing focused on role-based access control and input validation will further strengthen the security posture against privilege escalation attacks that exploit misconfigured permission systems.