CVE-2026-105090Published
Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custo…
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-105090 · Microsoft / collected KEV context
cve-program · CVE-2026-105090
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.