CVE-2026-105090

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.

• CWE-863

• https://github.com/formbricks/formbricks/pull/9432
• https://github.com/formbricks/formbricks/releases/tag/5.4.4
• https://github.com/formbricks/formbricks/releases/tag/6.0.1
• https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html

Published

Oct 3, 2026

Last Modified

Oct 3, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105048The Playground feature of Zilliz Attu before 3.0.0 allows SS…4
• CVE-2026-105049Zilliz Attu before 3.0.0 has a Playground feature that does …5.8
• CVE-2026-105050PeaZip before 11.3.0, in a non-default configuration, is vul…7.1
• CVE-2026-105051Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hyp…1.9
• CVE-2026-105080In ConvertX before 0.19.0, converters/calibre.ts does not bl…9.9
• CVE-2026-105083ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy …3.9
• CVE-2026-105096A vulnerability was determined in Omega Solution CoinEx Cryp…6.3
• CVE-2026-105097A vulnerability was identified in Omega Solution CoinEx Cryp…4.3
• CVE-2026-105098A security flaw has been discovered in Omega Solution CoinEx…4.3
• CVE-2026-105099A weakness has been identified in Omega Solution CoinEx Cryp…3.5
• CVE-2026-1051The Newsletter – Send awesome emails from WordPress plugin f…4.3
• CVE-2026-10510Cross-Site Scripting (XSS) in GeniexWebView component in Tra…6.1