Authentication Bypass in Appsmith Exposing Sensitive Information

CVE-2026-24042

What is CVE-2026-24042?

Appsmith, a platform for building admin panels and internal tools, is affected by a serious vulnerability in versions 1.94 and below. This issue allows unauthenticated users to perform unpublished actions by manipulating the API endpoint, specifically through the POST /api/v1/actions/execute call. By setting viewMode=false or omitting it, these unauthorized users can execute edit-mode actions that typically should remain restricted. This could lead to the exposure of sensitive data, execution of unintended queries, and access to development environments, posing significant risks to organizations using the platform. As of now, no fix has been released to address this vulnerability.

References