CVE-2026-24042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24042", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.777Z", "datePublished": "2026-01-22T03:52:54.463Z", "dateUpdated": "2026-01-22T12:28:28.202Z"}, "containers": {"cna": {"title": "Appsmith public apps can execute unpublished actions (viewMode confusion)", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883"}], "affected": [{"vendor": "appsmithorg", "product": "appsmith", "versions": [{"version": "<= 1.94", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:52:54.463Z"}, "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit\u2011mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication."}], "source": {"advisory": "GHSA-j9qq-4fj9-9883", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T12:27:45.874857Z", "id": "CVE-2026-24042", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:28:28.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T12:27:45.874857Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:28:19.380Z"}}], "cna": {"title": "Appsmith public apps can execute unpublished actions (viewMode confusion)", "source": {"advisory": "GHSA-j9qq-4fj9-9883", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "appsmithorg", "product": "appsmith", "versions": [{"status": "affected", "version": "<= 1.94"}]}], "references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883", "name": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit\u2011mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T03:52:54.463Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24042", "state": "PUBLISHED", "dateUpdated": "2026-01-22T12:28:28.202Z", "dateReserved": "2026-01-20T22:30:11.777Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T03:52:54.463Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "appsmith", "vendor": "appsmithorg", "versions": [{"status": "affected", "version": "<= 1.94"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0D385D9-E0EC-4CED-AB28-87B2CD03C5E8", "versionEndIncluding": "1.94", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit\u2011mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication."}, {"lang": "es", "value": "Appsmith es una plataforma para construir paneles de administraci\u00f3n, herramientas internas y paneles de control. En las versiones 1.94 e inferiores, las aplicaciones de acceso p\u00fablico permiten a usuarios no autenticados ejecutar acciones no publicadas (en modo edici\u00f3n) enviando viewMode=false (o omiti\u00e9ndolo) a POST /API/v1/actions/execute. Esto elude el l\u00edmite de publicaci\u00f3n esperado donde los espectadores p\u00fablicos solo deber\u00edan ejecutar acciones publicadas, no versiones en modo edici\u00f3n. Un ataque puede resultar en exposici\u00f3n de datos sensibles, ejecuci\u00f3n de consultas y API en modo edici\u00f3n, acceso a datos de desarrollo y la capacidad de desencadenar comportamientos con efectos secundarios. Este problema no tiene una soluci\u00f3n publicada en el momento de la publicaci\u00f3n."}], "id": "CVE-2026-24042", "lastModified": "2026-06-17T10:22:30.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24042", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T12:27:45.874857Z", "version": "2.0.3"}}]}, "published": "2026-01-22T04:16:00.187", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:53:05.747497+00:00", "value": {"mitigation_remediation": ["Upgrade Appsmith to a version newer than 1.94 or the latest available release. ", "Restrict or disable public access to apps that contain edit\u2011mode actions, ensuring only properly published actions are exposed. ", "Monitor traffic for POST requests to /api/v1/actions/execute with viewMode=false and block or quarantine any suspicious activity."], "summary": {"action": "Immediate Upgrade", "impact": "Unauthorized Data Exposure & Unpublished Action Execution"}, "threat_synthesis": {"affected_systems": "The affected vendor is Appsmith, specifically the appsmith org product. All releases at or below version 1.94 are impacted. No higher versions were listed in the advisory; newer releases have presumably removed the flaw.", "description_and_impact": "Appsmith versions 1.94 and older allow any user with internet access to trigger edit\u2011mode, unpublished actions by making a POST request to /api/v1/actions/execute with viewMode=false (or omitting the flag). This bypasses the supposed boundary that public viewers should only run published actions, enabling the attacker to read sensitive data, run edit\u2011mode queries or APIs, and trigger side\u2011effect behaviors. The vulnerability is a classic example of missing access control for authorized actions.", "risk_and_exploitability": "The CVSS base score of 9.4 indicates critical severity, while the EPSS score is below 1%\u2014the exploit probability is low but non\u2011zero. The vulnerability is not listed in the CISA KEV catalog, but since it is reachable by unauthenticated users on any public Appsmith app, the practical risk is high. Attackers need only identify a public app and send a crafted request; no special credentials or prior knowledge are required. The lack of an available patch at the time of the advisory further compounds the risk, making mitigation actions essential."}}}}, "created": "2026-01-22T10:08:09.372786+00:00", "updated": "2026-04-18T04:00:08.409113+00:00", "vendors": ["appsmith", "appsmith$PRODUCT$appsmith"]}