Medium
Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
Type: advisorySources: OSV
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-110620
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 19:51 UTC · Revision 1
Source evidence
Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
core-osv · Original sourcePublished 14 Oct 2026, 14:16 UTC
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
osv:CVE-2026-110620
Complete source record
{
"id": "94b13e879b13b6175b590bfd38d23db3ddb265734b17df5c7f44e8262dc97f3f",
"url": "https://osv.dev/vulnerability/CVE-2026-110620",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId",
"summary": "Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.",
"evidence": "osv:CVE-2026-110620",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-110620",
"aliases": [
"CVE-2026-110620"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/formbricks/formbricks",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e823e10f9a2fd19909056399cb3ffc58ffe3ee8e"
},
{
"fixed": "c7faa29437ea706eae411958b260bb5ad5c60e4f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.9.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "c7faa29437ea706eae411958b260bb5ad5c60e4f"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e823e10f9a2fd19909056399cb3ffc58ffe3ee8e"
}
],
"source": "REFERENCES_TAG",
"original_tag": "4.9.0"
}
]
}
}
],
"versions": [
"4.8.0-rc.2",
"4.8.0",
"4.8.0-rc.1",
"4.7.0-rc.1",
"4.6.0-rc.1",
"v4.5.0-rc.1",
"4.4.0-rc.1",
"4.3.0-rc.1",
"4.3.0",
"v3.17.0-rc.1",
"v3.14.0",
"v3.13.1",
"v3.13.0",
"v3.12.0",
"v3.11.0",
"v3.10.3",
"v3.10.2",
"v3.10.1",
"v3.10.0",
"v3.9.2",
"v3.9.1",
"v3.9.0",
"v3.8.7",
"v3.8.6",
"v3.8.5",
"v3.8.4",
"v3.8.3",
"v3.8.2",
"v3.8.1",
"v3.8.0",
"v3.7.1",
"v3.7.0",
"v3.6.2",
"v3.6.1",
"v3.6.0",
"v3.5.1",
"v3.5.0",
"v3.4.1",
"v3.4.0",
"v3.3.1",
"v3.3.0",
"v3.2.0",
"v3.1.5",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.0",
"v2.7.1",
"v2.7.0",
"v2.6.0",
"v2.5.3",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.3",
"v2.4.2",
"v2.4.0",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.2",
"v2.2.1",
"v2.2",
"v2.1.1",
"v2.1.0",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.6.1",
"v1.6.0",
"v1.5.1",
"v1.5.0",
"v1.4.2",
"v1.4.1",
"v1.4.0",
"v1.3.5",
"@formbricks/surveys@1.0.1",
"@formbricks/js@1.2.7",
"v1.3.4",
"@formbricks/js@1.2.6",
"v1.3.3",
"@formbricks/js@1.2.5",
"v1.3.2",
"@formbricks/js@1.2.4",
"@formbricks/js@1.2.3",
"v1.3.1",
"@formbricks/api@1.1.0",
"@formbricks/js@1.2.2",
"@formbricks/js@1.2.1",
"v1.3.0",
"@formbricks/js@1.2.0",
"v1.2.2",
"v1.2.0",
"v1.2.1",
"@formbricks/js@1.1.4",
"@formbricks/js@1.1.3",
"@formbricks/api@1.0.0",
"@formbricks/js@1.1.0",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.3",
"@formbricks/js@1.0.6",
"@formbricks/js@1.0.5",
"v1.0.2",
"@formbricks/js@1.0.3",
"@formbricks/js@1.0.4",
"@formbricks/js@1.0.2",
"v1.0.1",
"@formbricks/js@1.0.1",
"v1.0",
"@formbricks/js@1.0.0",
"v0.15",
"v0.14",
"v0.13",
"v0.12",
"v0.11",
"v0.10",
"v0.8",
"@formbricks/react@0.2.0",
"@formbricks/react@0.0.3",
"v0.4.0",
"v0.3.0",
"v0.2.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110620.json"
}
}
],
"modified": "2026-10-28T02:30:38.879587625Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110620.json",
"https://github.com/formbricks/formbricks/releases/tag/4.9.0",
"https://nvd.nist.gov/vuln/detail/CVE-2026-110620",
"https://www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid",
"https://github.com/formbricks/formbricks/issues/7326",
"https://github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f",
"https://github.com/formbricks/formbricks",
"https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts#L65-L95",
"https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110620.json"
}
},
"related_cves": [
{
"value": "CVE-2026-110620",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 506371,
"published_at": "2026-10-14T14:16:57.917+00:00"
}