CVE-2026-110620: falha de média gravidade em formbricks
Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.6%
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
formbricks · formbricksCVEs relacionadas — formbricks
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts#L65-L95https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50https://github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4fhttps://github.com/formbricks/formbricks/issues/7326https://github.com/formbricks/formbricks/releases/tag/4.9.0https://www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid