Vulnerability · Published Jan 22, 2026 · Assigned by GitHub_M

CVE-2026-24042Appsmith public apps can execute unpublished actions (viewMode confusion)

Critical 9.4

In plain English

A critical-severity missing authorization in appsmith from appsmithorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)0.6%top 49.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.

Affected products (as reported)

Vendor	Product	Versions
appsmithorg	appsmith	<= 1.94

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883 x_refsource_CONFIRM