CVE-2026-30862

The vulnerability results from lack of input data sanitization in the React component rendering pipeline — malicious attributes can be injected directly into the DOM. An attacker with a regular user account exploits the 'Invite Users' feature to deliver a malicious XSS payload. When the System Administrator views the infected widget, the browser executes a script that calls a privileged API endpoint (/api/v1/admin/env) on their behalf. As a result, the attacker gains full takeover of the administrative account (Full Administrative Account Takeover).

An attacker can gain full control over the System Administrator account, thereby obtaining unlimited access to environmental configuration and all data managed by the Appsmith platform.

Appsmith should be updated to version 1.96 or later, in which the vendor removed the described vulnerability by implementing proper HTML sanitization.

Appsmith in all versions prior to 1.96.