Authentication Bypass in Appsmith Exposing Sensitive Information

CVE-2026-24042

What is CVE-2026-24042?

Appsmith, a platform for building admin panels and internal tools, is affected by a serious vulnerability in versions 1.94 and below. This issue allows unauthenticated users to perform unpublished actions by manipulating the API endpoint, specifically through the POST /api/v1/actions/execute call. By setting viewMode=false or omitting it, these unauthorized users can execute edit-mode actions that typically should remain restricted. This could lead to the exposure of sensitive data, execution of unintended queries, and access to development environments, posing significant risks to organizations using the platform. As of now, no fix has been released to address this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References