Skip to content
OpenAdvisories

Product · appsmithorg

appsmith

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-55454

    Appsmith: Caddy admin API exposed without authentication

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not direct…

    appsmithorg appsmith
  • Critical 9.1
    CVE-2026-30862 Public exploit

    Critical Stored XSS & Privilege Escalation in Appsmith

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipelin…

    appsmithorg appsmith
  • Critical 9.4
    CVE-2026-24042

    Appsmith public apps can execute unpublished actions (viewMode confusion)

    Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v…

    appsmithorg appsmith
  • Critical 9.7
    CVE-2026-22794 Public exploit

    Account Takeover Vulnerability in Appsmith

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email ver…

    appsmithorg appsmith