Vulnerability in formbricks

[ Description ]Official description

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5Benvironm…
• github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/team…
• github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f
• github.com/formbricks/formbricks/issues/7326
• github.com/formbricks/formbricks/releases/tag/4.9.0
• www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-…