Read the docs
TI-2024-36913 Aliases CVE-2024-55604

Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

Priority LOW 22CWE-280Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed appsmith (appsmithorg): 1.51

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
appsmithorgappsmithbefore 1.511.51Patch availableCNA
  • appsmith Vendorappsmithorg Affected before 1.51 Fixed in 1.51 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*before 1.51Vulnerableappsmithorg
  • cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:* Versions before 1.51 Vulnerable ·appsmithorg

Remediation

  • Fix · CNA appsmith (appsmithorg) Fixed in 1.51

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-55604

References

Advisory 1

  • TI-2026-40018 Appsmith: Caddy admin API exposed without authentication CVSS 3.1CRITICAL 9.9
  • TI-2026-18312 Account Takeover Vulnerability in Appsmith CVSS 3.1CRITICAL 9.7
  • TI-2026-36948 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route CVSS 4.0HIGH 8.9
  • TI-2026-23691 Critical Stored XSS & Privilege Escalation in Appsmith CVSS 3.1CRITICAL 9.1
  • TI-2024-34357 AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json… CVSS 3.1HIGH 8.5
  • TI-2022-03744 Server-Side Request Forgery (SSRF) in appsmithorg/appsmith CVSS 3.1MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences