Appsmithorg vulnerabilities
We track 7 vulnerabilities in Appsmithorg products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2026.
Latest Appsmithorg vulnerabilities
- 9.1 Critical severity
appsmith: Server-Side Request Forgery
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. Th
- 9.9 Critical severity
appsmith: Exposed Dangerous Method or Function
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directl
- 7.2 High severity
appsmith: Permissive List of Allowed Inputs
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the p
- 7.3 High severity
appsmith: Server-Side Request Forgery
A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation lead
- 9.0 Critical severity
appsmith: Improper Neutralization of Input During Web Page Generation
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline
- 9.8 Critical severity
appsmith: Missing Authorization
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1
- 8.8 High severity
appsmith: Origin Validation Error
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email veri