CVE-2026-110620

Executive Summary

CVE-2026-110620 is an authorization bypass vulnerability (CWE-639) in Formbricks affected versions prior to 4.9.0. Server actions such as resetSurveyAction and updateSegmentAction fail to verify resource ownership against the supplied organizationId, allowing an authenticated owner or manager of any organization to manipulate victim resources — deleting survey responses, modifying segments and quotas, or altering pending invitations — by pairing their own organization identifier with victim resource IDs. The vulnerability is network-reachable, requires low privileges, and has high integrity and availability impact, though no confidentiality impact is scored.

Technical Analysis

Formbricks is an open-source survey and experience-management platform that exposes server-side actions (server actions in the Next.js sense) for administrative operations such as resetting survey data and updating segments. The core defect is an Insecure Direct Object Reference combined with missing horizontal authorization enforcement — CWE-639. The server actions cited in the NVD description (resetSurveyAction, updateSegmentAction) accept both a resource identifier and an organizationId from the client but do not confirm that the authenticated principal actually owns or administers the resource referenced by the resource ID within the organization named by organizationId.

Because the ownership check is absent, the authorization boundary is effectively the caller's own membership in some organization rather than a binding between the caller and the specific resource. An authenticated owner or manager of Organization A can therefore submit a request that names Organization A as the organizationId while referencing a resource ID that belongs to Organization B. The server accepts the combination and performs the privileged operation against the victim's resource.

The vulnerability class is an authorization bypass via parameter tampering / IDOR across tenant boundaries. The NVD description explicitly identifies the affected operation classes:

• Deleting survey responses
• Modifying segments and quotas
• Altering pending invitations

No specific URL endpoints, controller paths, or parameter names beyond organizationId are provided in the source data, so endpoint-level reconstruction is not possible from the available intelligence. The attack requires authentication (PR:L) and is network-reachable (AV:N). The CVSS complexity rating is High (AC:H) which is consistent with the requirement that the attacker know or discover victim resource IDs and craft a valid organization/resource ID pairing. There is no confidentiality impact (C:N); the effects are integrity (I:H) and availability (A:H), matching the destructive/modifying operations described.

The absence of a vendor fix (patch confidence 0/4) means no code-level diff is available to confirm the exact guard that was added. The remediation implied by the description is that version 4.9.0 adds resource-ownership verification against the supplied organizationId.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-110620. The attack chain below is inferred strictly from the NVD description and the vulnerability class (CWE-639). No function names, endpoints, or parameters beyond those in the NVD description are asserted.

1. Reconnaissance / target identification. The attacker requires a legitimate authenticated account that holds an owner or manager role in at least one Formbricks organization. This is the "low privilege" foothold. The attacker then enumerates or obtains target resource identifiers (survey response IDs, segment IDs, quota IDs, invitation IDs) belonging to victim organizations. In a multi-tenant deployment these IDs may be guessable, leaked through exports, or discoverable through normal authenticated usage.

2. Triggering the flaw. Using their own organization context, the attacker issues a server action request — for example, the resetSurveyAction or updateSegmentAction operations named in the description — supplying their own organizationId together with a victim resource ID. The server action processes the request without verifying that the referenced resource actually belongs to the organization named in organizationId, so the authorization check passes on the basis of the attacker's organization membership alone.

3. Execution at the vulnerability-class level. The payload is an authenticated, likely HTTP POST carrying the organizationId parameter plus a target resource identifier. Because ownership is not validated, the server executes the privileged mutation. This is a parameter-tampering / IDOR-class attack; the "payload" is the mismatched identifier pair rather than exploit shellcode.

4. Post-exploitation impact. Successful exploitation results in destructive or modifying operations on victim tenants: deletion of survey responses, alteration of segment and quota definitions, and modification or cancellation of pending invitations. The integrity and availability impacts are high, enabling data destruction, survey tampering, and interference with an organization's user onboarding (pending invitations). No confidentiality impact is scored, indicating the operations do not directly disclose victim data.

Impact Assessment

The vulnerability has a CVSS v3.1 base score of 6.8 (Medium). The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H:

• AV:N (Network): exploitable remotely over the network without local access.
• AC:H (High): exploitation conditions are non-trivial, consistent with the need to obtain valid target resource IDs and construct a valid organization/resource pairing.
• PR:L (Low): requires an authenticated account with owner/manager privileges in any organization.
• UI:N (None): no victim interaction required.
• S:U (Unchanged): impact is confined to the vulnerable component's security scope.
• C:N (None): no confidentiality impact.
• I:H (High): high integrity impact — surveys, segments, quotas, and invitations can be modified or deleted.
• A:H (High): high availability impact — deletion of survey responses and modification of critical data can disrupt operations.

Business impact. Because Formbricks is a multi-tenant survey platform, the blast radius spans all organizations hosted on the same instance. Any tenant with an owner/manager role can affect other tenants' data. This is a cross-tenant integrity and availability issue that undermines the platform's core tenant-isolation guarantee. Organizations relying on Formbricks for compliance-sensitive surveys, user onboarding (pending invitations), or quota-controlled data collection face data destruction and integrity compromise. The vulnerability is unpatched in all versions prior to 4.9.0, and there is no CISA KEV listing, no public exploit, and no EPSS score reported.

Detection Guidance

Sigma Rule

title: Formbricks Cross-Tenant Authorization Bypass via organizationId
id: 7f3a9c21-4b6e-4d2a-9c1b-formbricks639
status: experimental
description: Detects authenticated Formbricks requests where a server action (e.g. resetSurveyAction, updateSegmentAction) pairs an organizationId with a resource ID that does not belong to that organization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110620
author: valtersit.com
logsource:
  category: application
  product: formbricks
detection:
  selection_action:
    action|contains:
      - 'resetSurveyAction'
      - 'updateSegmentAction'
  selection_org:
    organizationId|exists: true
  selection_resource:
    resourceId|exists: true
  condition: selection_action and selection_org and selection_resource
fields:
  - sourceIP
  - user
  - organizationId
  - resourceId
  - action
falsepositives:
  - Legitimate administrative activity within the caller's own organization
level: high
tags:
  - attack.t1078
  - cve.2026-110620

YARA Rule

rule CVE_2026_110620_Formbricks_AuthzBypass
{
    meta:
        description = "Detects references to Formbricks server actions associated with CVE-2026-110620 cross-tenant authorization bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110620"
        date = "2026-01-01"
        cve = "CVE-2026-110620"

    strings:
        $s1 = "resetSurveyAction" ascii wide nocase
        $s2 = "updateSegmentAction" ascii wide nocase
        $s3 = "organizationId" ascii wide
        $s4 = "formbricks" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        ($s4 and (any of ($s1, $s2)) and $s3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110620 Formbricks Cross-Tenant Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"formbricks"; nocase; http.request_body; content:"resetSurveyAction"; nocase; http.request_body; content:"organizationId"; nocase; sid:2026110620; rev:1; reference:cve,CVE-2026-110620; classtype:attempted-admin; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "POST" and
   http.request.body.text contains "resetSurveyAction"] with runs=1

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=formbricks
| where match(_raw, "(?i)resetSurveyAction|updateSegmentAction")
| where match(_raw, "(?i)organizationId")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris by src_ip, user, organizationId
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="formbricks,cve-2026-110620,">
  <rule id="202611" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">resetSurveyAction|updateSegmentAction</field>
    <field name="organizationId">\.+</field>
    <description>CVE-2026-110620: Formbricks cross-tenant authorization bypass attempt via organizationId on server action</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor advisory, no workaround, and no patch reference available in the tracked data. The NVD description states that Formbricks before 4.9.0 is affected and that the fix adds resource-ownership verification against the supplied organizationId, implying remediation in 4.9.0.

1. Immediate mitigations (compensating controls):

   • Restrict owner/manager roles to fully trusted principals until upgraded; the vulnerability requires an owner/manager account in any organization.
   • Enforce network-level access controls (VPN, IP allowlisting, or reverse-proxy authentication) in front of Formbricks to reduce the pool of authenticated principals who can reach the affected server actions.
   • Monitor and alert on server-action requests where the organizationId does not correspond to resources accessed by the same principal (see Detection Guidance).
   • Audit recently modified/deleted survey responses, segments, quotas, and pending invitations across organizations for unexplained changes.

2. Patch / upgrade steps:

   • Upgrade Formbricks to version 4.9.0 or later, per the NVD description stating "Formbricks before 4.9.0" is affected.
   • Because no patch hash or advisory is available, validate the fix by testing that server actions reject resource IDs belonging to a different organizationId than the caller's own.

3. Long-term hardening:

   • Adopt a centralized, mandatory authorization layer that binds every resource mutation to the authenticated principal's ownership of that resource, independent of client-supplied organizationId.
   • Implement server-side tenant-isolation tests (cross-tenant IDOR regression tests) in CI for all administrative server actions.
   • Apply least-privilege role design so owner/manager roles are scoped narrowly within their own organizations.
   • Enable comprehensive audit logging of segment, quota, invitation, and survey-response mutations with organization and resource context.

References

• NVD — CVE-2026-110620: https://nvd.nist.gov/vuln/detail/CVE-2026-110620
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Formbricks project (vendor/product source): https://formbricks.com
• FIRST.org EPSS: Not yet scored for CVE-2026-110620 (do not assume a value).
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-110620 is NOT listed as of this report.

No threat actor campaigns, exploit-in-the-wild evidence, public proof-of-concept, or Nuclei template are known for this CVE in the provided intelligence. The attack chain is inferred from the vulnerability class (CWE-639) and the NVD description only.