appsmith vulnerabilities

7 known vulnerabilities in appsmith from Appsmithorg. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  appsmith: Server-Side Request Forgery

  CVE-2026-55455Jun 24, 2026Appsmithorg

  Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. Th

• 9.9 Critical severity

  appsmith: Exposed Dangerous Method or Function

  CVE-2026-55454Jun 24, 2026Appsmithorg

  Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directl

• 7.2 High severity

  appsmith: Permissive List of Allowed Inputs

  CVE-2026-50189Jun 24, 2026Appsmithorg

  Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the p

• 7.3 High severity

  appsmith: Server-Side Request Forgery

  CVE-2026-5418Apr 2, 2026Appsmithorg

  A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation lead

• 9.0 Critical severity

  appsmith: Improper Neutralization of Input During Web Page Generation

  CVE-2026-30862Mar 10, 2026Appsmithorg

  Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline

• 9.8 Critical severity

  appsmith: Missing Authorization

  CVE-2026-24042Jan 22, 2026Appsmithorg

  Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1

• 8.8 High severity

  appsmith: Origin Validation Error

  CVE-2026-22794Jan 12, 2026Appsmithorg

  Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email veri