CVE-2026-30862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30862", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:27:35.342Z", "datePublished": "2026-03-09T22:26:11.163Z", "dateUpdated": "2026-03-10T14:19:20.885Z"}, "containers": {"cna": {"title": "Critical Stored XSS & Privilege Escalation in Appsmith", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794"}], "affected": [{"vendor": "appsmithorg", "product": "appsmith", "versions": [{"version": "< 1.96", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:26:11.163Z"}, "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the \"Invite Users\" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96."}], "source": {"advisory": "GHSA-5hw4-whxv-6794", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:19:16.121188Z", "id": "CVE-2026-30862", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:19:20.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30862", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T14:19:16.121188Z"}}}], "references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:19:10.529Z"}}], "cna": {"title": "Critical Stored XSS & Privilege Escalation in Appsmith", "source": {"advisory": "GHSA-5hw4-whxv-6794", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "appsmithorg", "product": "appsmith", "versions": [{"status": "affected", "version": "< 1.96"}]}], "references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794", "name": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the \"Invite Users\" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:26:11.163Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30862", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:19:20.885Z", "dateReserved": "2026-03-05T21:27:35.342Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T22:26:11.163Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "appsmith", "vendor": "appsmithorg", "versions": [{"status": "affected", "version": "< 1.96"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB36CCD5-B655-45E3-97B3-FC5FC2B79B6B", "versionEndExcluding": "1.96", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the \"Invite Users\" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96."}, {"lang": "es", "value": "Appsmith es una plataforma para construir paneles de administraci\u00f3n, herramientas internas y cuadros de mando. Anterior a la 1.96, existe una vulnerabilidad XSS Almacenado Cr\u00edtica en el Widget de Tabla (TableWidgetV2). La causa ra\u00edz es una falta de saneamiento de HTML en el pipeline de renderizado de componentes de React, permitiendo que atributos maliciosos sean interpolados en el DOM. Aprovechando la caracter\u00edstica 'Invitar Usuarios', un atacante con una cuenta de usuario regular (user@gmail.com) puede forzar a un Administrador del Sistema a ejecutar una llamada a la API con altos privilegios (/api/v1/admin/env), resultando en una Toma de Control Completa de la Cuenta Administrativa. Esta vulnerabilidad est\u00e1 corregida en la 1.96."}], "id": "CVE-2026-30862", "lastModified": "2026-06-17T10:33:03.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30862", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:19:16.121188Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:40:14.123", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.96)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "appsmith", "source": "cna", "vendor": "appsmithorg"}, "product": "appsmith", "vendor": "appsmith"}], "analysis": {"en": {"generated_at": "2026-04-16T10:03:32.356831+00:00", "value": {"mitigation_remediation": ["Apply the Appsmith patch to version 1.96 or later, which includes proper HTML sanitization for the TableWidgetV2 component.", "Disable or restrict the Invite Users feature for non\u2011trusted users until a patch is available, or enforce role\u2011based restrictions so that only administrators can invite new users.", "Implement a strict Content Security Policy that disallows inline scripts and whitelists only approved sources to mitigate potential XSS exploitation."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Stored XSS"}, "threat_synthesis": {"affected_systems": "Appsmith platforms delivering admin panels, internal tools, or dashboards, specifically those manufactured by Appsmith.org and running any version earlier than 1.96. Users of TableWidgetV2 components in these deployments are at risk until the patch is applied.", "description_and_impact": "A stored cross\u2011site scripting flaw exists in the TableWidgetV2 component of Appsmith versions prior to 1.96. The flaw arises from missing HTML sanitization in the React rendering pipeline, allowing an attacker to inject malicious attributes that are rendered by browsers. When an ordinary user triggers the \"Invite Users\" functionality, the injected code causes a System Administrator to unknowingly execute a high\u2011privileged API call to \"/api/v1/admin/env\", leading to full administrative takeover. The vulnerability therefore combines a client\u2011side scripting defect (CWE\u201179) with a privilege escalation outcome.", "risk_and_exploitability": "The CVSS rating of 9.1 indicates a severe attack, and although the EPSS score is less than 1%, the workaround is straightforward for an attacker with a low\u2011privilege account. The vulnerability is not currently listed in CISA\u2019s KEV catalog, but the chain of exploitation requires only access to the invite feature and a legitimate user session. Once the attacker supplies the malicious payload, no additional network access or credentials are needed beyond that of a regular user. The exploit path leverages cross\u2011site scripting in the client side to force a privileged API call, so an attacker can elevate privileges without elevating network privileges."}}}}, "created": "2026-03-10T14:06:35.530815+00:00", "updated": "2026-04-16T10:15:26.104121+00:00", "vendors": ["appsmith", "appsmith$PRODUCT$appsmith"]}