Is CVE-2026-105090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105090 being exploited in the wild.

How severe is CVE-2026-105090?

Informational severity, published 3 October 2026.

Which products and versions are affected?

Formbricks before 5.4.4 and 6 before 6.0.1.

Is there a fix for CVE-2026-105090?

Yes: fixed in 5.4.4, 6.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105090 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105090?

Check whether you run Formbricks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105090: Formbricks stored XSS in survey Custom Head Scripts

CVE-2026-105090 · Severity: info · Published 2026-10-03

Formbricks is an open-source survey platform used to collect user feedback. A privilege escalation vulnerability allows workspace members with basic read-write permissions to inject malicious JavaScript into surveys through a "Custom Head Scripts" feature, which then executes in the browser sessions of all users who view the affected survey, including administrators. This allows lower-privileged attackers to steal session tokens, credentials, or sensitive data from higher-privileged users.

Technologies: Formbricks. Vendors: Formbricks.

Quick answers

Is CVE-2026-105090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105090 being exploited in the wild.
How severe is CVE-2026-105090?: Informational severity, published 3 October 2026.
Which products and versions are affected?: Formbricks before 5.4.4 and 6 before 6.0.1.
Is there a fix for CVE-2026-105090?: Yes: fixed in 5.4.4, 6.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105090 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105090?: Check whether you run Formbricks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.4.4, 6.0.1

Technical details

The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary, allowing users with only readWrite role to modify scripts that execute in authenticated user sessions. The vulnerability is a stored XSS (CWE-79) resulting from insufficient authorization checks on a script injection endpoint. An attacker with workspace member privileges can inject arbitrary JavaScript that persists in the survey configuration and executes for all viewers, enabling account takeover or lateral privilege escalation to administrative accounts.

Affected products

Formbricks Formbricks before 5.4.4 and 6 before 6.0.1

Timeline

2026-10-03: disclosed
2026-09-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.