CVE-2026-110620

Versions of Formbricks prior to 4.9.0 are vulnerable to a Cross-Organization IDOR (Insecure Direct Object Reference) flaw. The root cause is an authorization bypass where server actions, such as resetSurveyAction and updateSegmentAction, fail to verify if the provided organizationId owns the targ...

EUVD-2026-101248

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...