CRITICAL🇵🇱 Wersja polska

CVE-2026-30862

CVSS 9.0v3.1pub. 2026-03-10upd. 2026-03-13

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

  • Appsmith

    APP
    Appsmith
    < 1.96
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-55454CRITICAL9.9PL ✓ten sam produkt

Appsmith: SSRF umożliwia przejęcie konfiguracji reverse proxy Caddy

CVE-2026-24042CRITICAL9.4PL ✓ten sam produkt

Appsmith: nieuwierzytelniony dostęp do akcji trybu edycji (brak autoryzacji)

CVE-2026-22794CRITICAL9.6PL ✓ten sam produkt

Appsmith: przejęcie konta przez manipulację nagłówkiem Origin w linkach e-mail

CVE-2024-55964CRITICAL9.8PL ✓ten sam produkt

Appsmith: RCE przez błędnie skonfigurowany PostgreSQL w kontenerze Docker

CVE-2026-50189HIGH8.9ten sam produkt

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled...