Threats affecting pkg:github/formbricks

Formbricks versions prior to 4.9.0 have an authorization bypass vulnerability in certain server actions that do not properly verify resource ownership against the provided organizationId. Authenticated users who are owners or managers of any organization can exploit this flaw to manipulate resources belonging to other organizations, including deleting survey responses, modifying segments and quotas, or altering pending invitations. The issue is fixed in version 4.9.0.

Formbricks versions before 5.4.4 and 6 before 6.0.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the Custom Head Scripts feature at the survey level does not enforce the intended Manage permission boundary, allowing users with readWrite permission to configure scripts. These scripts execute in the authenticated browser session of any user who opens the affected survey, enabling lower-privileged users to run arbitrary JavaScript in higher-privileged users' sessions. The issue is fixed by requiring Manage access to modify survey Custom Head Scripts.

A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the component Survey Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. Upgrading to version 5.1.0-rc.1 will fix this issue. The identifier of the patch is af6023b5ac3b030ffcea24fac799f76f3e3512c6. You should upgrade the affected component.