CVE-2026-110620EPSS p45.3%

CVE-2026-110620CVE-2026-110620

Description

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS0.56% probability of exploitation · percentile 45.3% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.