CVE-2026-105090

Executive Summary

CVE-2026-105090 is a stored cross-site scripting (XSS) vulnerability in Formbricks, an open-source survey and experience-management platform. A workspace member holding only the readWrite permission can configure the survey-level "Custom Head Scripts" feature — an action the documentation explicitly restricts to the Manage role — because the feature failed to enforce that documented permission boundary. The injected scripts execute in the authenticated browser session of any higher-privileged user who opens the affected survey, enabling privilege escalation and session hijacking. The vulnerability is identified by its CNA as CWE-863 (Incorrect Authorization) and affects Formbricks before 5.4.4 and version 6 before 6.0.1.

Technical Analysis

The core defect in CVE-2026-105090 is an authorization boundary failure, classified as CWE-863 (Incorrect Authorization). Formbricks defines a role-based permission model in which workspace members can hold differing privilege levels, including at minimum a readWrite role and a higher Manage role. The platform's documentation states that configuring survey-level "Custom Head Scripts" is an operation reserved for the Manage role.

The vulnerability arises because the survey-level Custom Head Scripts feature did not enforce this documented permission boundary. The check that should have restricted modification of the Custom Head Scripts configuration to Manage holders was absent or ineffective, so a readWrite member could configure arbitrary script content there.

Custom Head Scripts is, by design, a feature that injects operator-supplied markup/JavaScript into the head section of the rendered survey. This is intended for legitimate customization (analytics, embeds, styling hooks). The security model depends entirely on trusting whoever can configure the field, because the configured content is then served to and executed by every browser that loads the affected survey.

Because a lower-privileged readWrite member can write into that field, the attacker gains an injection primitive that executes in the authenticated session of any user who visits the survey. The result is stored cross-site scripting: the malicious script persists in the survey configuration and fires whenever a more privileged user — for example an administrator or Manage-role member — opens the survey. This is the crux of the privilege boundary violation: the attacker operates at readWrite level but achieves code execution in higher-privileged sessions, bypassing the intended separation between "can edit survey content" and "can inject executable scripts."

The attack surface is the survey Custom Head Scripts configuration and the survey rendering/opening flow. It is a network-reachable, authenticated attack requiring low privileges, but — per the standard stored-XSS model described by the CNA — it requires the victim (a higher-privileged user) to open the affected survey, which is the interaction component of the attack.

No further code-level detail (specific handler names, API routes, request parameters, or source files) is provided in the available data; accordingly, none is asserted here. The mechanism is fully described at the vulnerability-class level: an authorization gap around a script-injection feature producing stored XSS in privileged sessions.

Exploitation Scenarios

Note: No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-105090 (PoC status: None). The attack chain below is inferred strictly from the vulnerability class (stored XSS via incorrect authorization) and the behavior described by the CNA. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker obtains a low-privileged account within a Formbricks workspace — specifically a membership holding only the readWrite permission (e.g., a contractor, junior team member, or a compromised low-privilege credential). Crucially, the attacker does not need the Manage role that the documentation says is required for Custom Head Scripts. The attacker identifies a survey within the workspace that higher-privileged users are likely to open (for example, a survey an administrator reviews or edits).

2. Triggering the flaw. The attacker uses their readWrite access to open the survey's Custom Head Scripts configuration and adds script content. Because the feature fails to enforce the documented Manage boundary, the write succeeds despite the attacker lacking Manage privileges. This is the incorrect-authorization step: the operation that should have been rejected is accepted.

3. Payload / execution method (vulnerability-class level). The attacker stores JavaScript in the Custom Head Scripts field. When any user — including a higher-privileged user such as an administrator or a Manage-role member — opens the affected survey, the stored script executes in that user's authenticated browser session. This is classic stored XSS: the payload is persisted server-side in the survey configuration and served/executed on subsequent views. No specific API call, header, or parameter is asserted because none is provided in the source data.

4. Post-exploitation impact. Because the script runs in the victim's authenticated session, the attacker can act with the victim's privileges — for example reading or exfiltrating survey data, performing actions the victim is authorized to perform, or interacting with the workspace as the higher-privileged user. The net effect is privilege escalation across the role boundary: a readWrite member effectively executes code in the context of Manage/administrator users. The impact is bounded by the privileges of the victim who opens the survey, but it directly defeats the intended permission model.

Impact Assessment

CVE-2026-105090 enables a low-privileged workspace member to run arbitrary JavaScript in the authenticated browser sessions of higher-privileged users. This is an integrity and confidentiality impact achieved through a privilege-boundary violation, consistent with a scope-changing stored XSS (the vulnerable boundary is between permission levels).

Affected systems are Formbricks deployments on versions before 5.4.4 and 6.x before 6.0.1. Blast radius within an affected workspace includes any user who opens a survey modified by the attacker — most seriously, Manage-role members and administrators, whose sessions may be used to perform privileged operations or to expose data the attacker could not reach directly.

Reference CVSS subscores (from the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N):

• Attack Vector (AV:N): Network — the survey is reachable over the network.
• Attack Complexity (AC:L): Low.
• Privileges Required (PR:L): Low — the attacker only needs readWrite membership.
• User Interaction (UI:R): Required — a higher-privileged user must open the affected survey.
• Scope (S:C): Changed — compromise of a lower-privileged account escalates into higher-privileged session context.
• Confidentiality (C:L) / Integrity (I:L): Low-to-moderate depending on the victim's privileges.
• Availability (A:N): None.

Business impact: Organizations using Formbricks for surveys that collect sensitive data, or where Survey Review/Mange roles are held by administrators, face risk of unauthorized data exposure and unauthorized privileged actions. Because the trigger is a stored, persistent payload, impact continues until the injected script is removed and the underlying authorization flaw is remediated.

EPSS: Not yet scored by FIRST.org — no EPSS value is available, and none is fabricated here. CISA KEV: Not listed. Exploit-in-the-wild: No public PoC, exploit code, or Nuclei template is available based on provided data; no known threat-actor campaigns are identified.

Detection Guidance

Sigma Rule

title: Formbricks Custom Head Scripts Modified by Non-Manage User (CVE-2026-105090)
id: 9f2c1a74-1050-90c0-8b3e-000000000001
status: experimental
description: Detects modification of survey-level Custom Head Scripts in Formbricks, which per CVE-2026-105090 could be performed by a readWrite-permission member lacking Manage rights, indicating possible stored XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105090
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: formbricks
  service: audit
detection:
  selection_action:
    action|contains:
      - 'customHeadScripts'
      - 'custom_head_scripts'
      - 'headScripts'
  selection_survey:
    resource_type: 'survey'
  filter_events:
    event_type:
      - 'survey.updated'
      - 'survey.created'
  condition: selection_action and selection_survey and filter_events
falsepositives:
  - Legitimate Manage-role users editing survey scripts
  - Administrative survey customization
level: medium
tags:
  - attack.t1059.007
  - cwe.863
  - cve.2026-105090

YARA Rule

rule CVE_2026_105090_Formbricks_CustomHeadScripts_StoredXSS
{
    meta:
        description = "Detects script content associated with Formbricks Custom Head Scripts stored XSS (CVE-2026-105090)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105090"
        cve = "CVE-2026-105090"

    strings:
        $fb1 = "customHeadScripts" ascii nocase
        $fb2 = "custom_head_scripts" ascii nocase
        $fb3 = "formbricks" ascii nocase
        $js1 = "<script" ascii nocase
        $js2 = "javascript:" ascii nocase

    condition:
        (any of ($fb1, $fb2)) and $fb3 and any of ($js1, $js2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105090 Formbricks Survey Custom Head Scripts Modification Attempt"; flow:established,to_server; http.method; content:"PATCH"; http.header; content:"formbricks"; http.request_body; content:"customHeadScripts"; nocase; http.request_body; content:"<script"; nocase; reference:cve,2026-105090; classtype:web-application-attack; sid:2026105090; rev:1;)

Elastic Detection

sequence by user.name, host.name with maxspan=5m
  [any where event.action == "survey.updated" and process.name : ("node" or "formbricks")]
  [any where event.action : ("survey.updated","survey.created") and
      (message : "*customHeadScripts*" or message : "*custom_head_scripts*")]

Splunk SPL Query

index=formbricks sourcetype=formbricks:audit
| search (action="*customHeadScripts*" OR action="*custom_head_scripts*" OR message="*Custom Head Scripts*")
| eval suspicious_script=if(match(_raw, "(?i)<script|javascript:|onerror=|onload="), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen by user, action, resource_type, resource_id, suspicious_script
| where suspicious_script="yes"
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Wazuh OSSEC Rule

<group name="formbricks,cve-2026-105090,web,">
  <rule id="105090" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">customHeadScripts</field>
    <description>CVE-2026-105090: Formbricks survey Custom Head Scripts modified (possible stored XSS / authorization bypass)</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_105090,</group>
  </rule>
  <rule id="105091" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">customHeadScripts</field>
    <regex type="pcre2">(?i)&lt;script|javascript:|onerror=</regex>
    <description>CVE-2026-105090: Formbricks Custom Head Scripts payload contains executable script content</description>
    <group>cve_2026_105090,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (patch confidence is 0/4 with no patch evidence from any tracked source, despite the NVD description citing fixed versions). Treat as unverified until a vendor advisory and release are confirmed.

1. Immediate mitigations

   • Restrict workspace membership: minimize the number of accounts holding readWrite and Manage roles on surveys; enforce least privilege.
   • Treat all survey-level Custom Head Scripts configuration as sensitive. Audit existing surveys for unexpected Custom Head Scripts content and remove any unrecognized or anomalous scripts.
   • Where feasible, disable or restrict the Custom Head Scripts feature at the product/organization level until the authorization boundary is confirmed enforced.
   • Monitor audit logs for Custom Head Scripts changes performed by users lacking the Manage role (see Detection Guidance).
   • Enforce Content Security Policy (CSP) headers on Formbricks deployments to reduce the execution of inline/injected scripts as a defense-in-depth measure.

2. Patch / upgrade steps

   • Per the NVD/CNA description, the issue is addressed in Formbricks 5.4.4 (5.x line) and Formbricks 6.0.1 (6.x line), with fixed versions requiring Manage access to modify survey Custom Head Scripts.
   • Upgrade 5.x deployments to 5.4.4 or later, and 6.x deployments to 6.0.1 or later. Verify the release notes confirm the permission boundary was enforced before relying on the fix; patch confidence remains 0/4 from tracked sources, so validate independently.
   • After upgrading, re-verify that only Manage-role members can modify Custom Head Scripts.

3. Long-term hardening

   • Implement and enforce centralized server-side authorization checks (RBAC) so that "documentation-only" permission boundaries are always code-enforced; audit other features for similar CWE-863 gaps.
   • Apply output encoding and sanitization to all operator-supplied fields, including script-injection features, and adopt a strict CSP.
   • Add regression tests around permission enforcement for privileged survey operations.
   • Continuously monitor audit logs and alert on authorization anomalies (low-privilege users performing privileged operations).

References

• NVD — CVE-2026-105090: https://nvd.nist.gov/vuln/detail/CVE-2026-105090
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1059.007 — JavaScript: https://attack.mitre.org/techniques/T1059/007/
• OWASP — Stored Cross Site Scripting: https://owasp.org/www-community/attacks/xss/
• Formbricks project / release documentation (verify 5.4.4 and 6.0.1 releases): https://github.com/formbricks/formbricks/releases

Threat actor / exploit-in-the-wild note: No CISA KEV listing, no public PoC, no exploit code, and no known threat-actor campaign is associated with CVE-2026-105090 based on the provided data.