Stored XSS Vulnerability in Formbricks Affecting User Permissions

CVE-2026-105090

What is CVE-2026-105090?

A security flaw in Formbricks allows a user with limited permissions to introduce malicious scripts via the Custom Head Scripts feature. Specifically, prior versions of Formbricks permitted workspace members with 'readWrite' permissions to alter survey scripts, bypassing the required 'Manage' role. This vulnerability enables the execution of arbitrary JavaScript in the browsers of users who access the affected surveys, thus potentially compromising session data. Updated versions now enforce stricter access controls, ensuring that only users with the appropriate permissions can modify these scripts.

References