Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-105090 (GCVE-0-2026-105090)

Vulnerability from cvelistv5 – Published: 2026-10-03 01:59 – Updated: 2026-10-03 01:59

Summary

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre mitre root

References

4 references

URL	Tags
https://github.com/formbricks/formbricks/releases…	release-notespatch
https://github.com/formbricks/formbricks/releases…	release-notespatch
https://github.com/formbricks/formbricks/pull/9432	patch
https://www.sec4check.pl/blog/posts/cve-formbrick…	technical-description

Impacted products

1 product

Vendor	Product	Version
Formbricks	Formbricks	Affected: 0 , < 5.4.4 (semver) Affected: 6.0.0 , < 6.0.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/formbricks/formbricks",
          "defaultStatus": "unaffected",
          "product": "Formbricks",
          "vendor": "Formbricks",
          "versions": [
            {
              "lessThan": "5.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.0.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T01:59:10.911Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "Formbricks release 6.0.1 (fix)",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/formbricks/formbricks/releases/tag/6.0.1"
        },
        {
          "name": "Formbricks release 5.4.4 (fix, backport)",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/formbricks/formbricks/releases/tag/5.4.4"
        },
        {
          "name": "PR #9432 - require Manage access to change survey custom head scripts",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/formbricks/formbricks/pull/9432"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-105090",
    "datePublished": "2026-10-03T01:59:10.911Z",
    "dateReserved": "2026-10-03T01:59:10.142Z",
    "dateUpdated": "2026-10-03T01:59:10.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59934 (GCVE-0-2025-59934)

Vulnerability from cvelistv5 – Published: 2025-09-26 23:03 – Updated: 2025-09-29 14:59

Title

Formbricks missing JWT signature verification

Summary

Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-29 14:59 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature
CWE-345 - Insufficient Verification of Data Authenticity
CWE-287 - Improper Authentication