CVE-2026-110620 in Formbricks
Summary
by MITRE • 10/14/2026
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Formbricks versions prior to 4.9.0 represents a critical authorization bypass flaw within the application's server-side action handlers. Specifically, functions such as resetSurveyAction and updateSegmentAction fail to perform adequate validation of resource ownership relative to the organization identifier provided by the client request. In secure software architecture, when an authenticated user interacts with resources belonging to a specific organizational unit, the system must verify that the user possesses the necessary permissions for both their own identity context and the target resource's associated entity. The absence of this cross-verification logic creates a significant security gap where the application trusts the organizationId parameter sent by the client without confirming its alignment with the actual ownership metadata stored in the database or backend systems.
This technical flaw allows authenticated users who hold owner or manager roles within any valid organization to manipulate resources belonging to other organizations through IDOR-style exploitation techniques. By supplying their own legitimate organization identifier alongside a victim resource's unique identifier, an attacker can trick the server into processing requests against targets they do not own but are permitted to access due to the missing ownership check. This mechanism effectively bypasses horizontal and vertical privilege controls intended to isolate data between different organizational tenants in multi-tenant environments. The vulnerability is particularly severe because it affects core administrative functions that manage survey responses, segment configurations, quota settings, and pending invitations, all of which require high-level privileges for modification or deletion.
The operational impact of this vulnerability extends beyond simple unauthorized access to include potential denial of service and data integrity compromise. Attackers can delete critical survey response data, leading to loss of valuable user insights and analytics that organizations rely upon for decision-making processes. Furthermore, the ability to modify segments and quotas allows adversaries to disrupt marketing campaigns or internal communication workflows by altering targeting criteria or resource limits arbitrarily. Altering pending invitations poses a risk to organizational security posture as it can lead to unauthorized individuals gaining access to sensitive systems or data repositories under false pretenses. These actions collectively undermine trust in the platform's ability to maintain strict multi-tenant isolation and protect customer data from malicious insiders or compromised accounts with elevated privileges within any single organization unit.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in verifying user authorization for specific resources. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation relies on using legitimate credentials combined with flawed logic to access unauthorized data. To mitigate this risk, immediate updates to Formbricks version 4.9.0 or later are required where these server actions have been patched to enforce strict ownership verification. Developers should implement robust backend validation that cross-references the requesting user's organization context against the target resource's metadata before executing any destructive or modifying operations. Additionally, adopting a principle of least privilege and ensuring all API endpoints validate both session integrity and resource association will prevent similar authorization bypasses in future development cycles.