Formbricks prior to 4.9.0 includes a server‑side authorization flaw that ignores ownership checks in actions such as resetSurveyAction and updateSegmentAction. An authenticated user with organizational owner or manager role can supply any organization ID and pair it with a victim resource ID, thereby deleting survey responses, altering segments and quotas, or changing pending invitations. The flaw directly leads to data tampering and potential data loss across unrelated organizations.

Formbricks web platform in all releases before 4.9.0, including the 4.8.x series (for example 4.8.7), is vulnerable. The product is deployed by the Formbricks team. Any instance that has previously installed a version older than 4.9.0 and has exposed server actions to authenticated users is at risk.

CVSS score is 6.1, indicating a medium severity. EPSS is reported as < 1% (approximately 0.00558), indicating a low but non‑zero exploit probability, and the vulnerability is not listed in CISA KEV. The attack requires authentication as a legitimate owner or manager of any organization in the system. Because the flaw bypasses organization binding, an attacker can target any organization by specifying its ID. The low EPSS suggests limited exploitation likelihood, but the known impact and lack of protection make the vulnerability a noteworthy risk.