CVE-2026-24042
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAppsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAppsmith versions 1.94 and below contain an authentication bypass where the /api/v1/actions/execute endpoint fails to properly enforce the publish boundary. Unauthenticated users can execute unpublished edit-mode actions by sending viewMode=false or omitting the parameter, allowing access to development queries, APIs, and sensitive data that should only exist in the edit environment.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 1.94CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check your Appsmith versionLog into the Appsmith admin console and look at the version number in the footer of any page, or query the health check endpoint if availableAffected if Your version is 1.94 or below (any version up to and including 1.94)
-
Identify publicly accessible applicationsIn the Appsmith admin panel, review all applications that have public access enabled via the Share button settings. Note the application IDs and names.Affected if Any application is shared publicly without authentication requirements
-
Verify unpublished actions exist in public appsFor each publicly accessible application, open the editor and review the actions. Identify any actions that exist in edit-mode but have not been published (actions marked as unpublished or those not included in the last published version)Affected if Public applications contain unpublished actions that have not been deployed to production
-
Test endpoint access with viewMode parameterSend a POST request to /api/v1/actions/execute with a known action ID from a public app, including viewMode=false in the request body, without providing authentication credentialsAffected if The request executes successfully and returns action results instead of being rejected due to unauthenticated access or viewMode restriction
You are affected if you run Appsmith version 1.94 or below, have any applications shared publicly, and the execute endpoint accepts unauthenticated requests with viewMode=false to run unpublished actions.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedSince no patch is available, restrict or disable public access to Appsmith applications immediately. Implement network-level access controls or WAF rules to block requests with viewMode=false or consider migrating sensitive applications to private access until an official fix is released.
- No remediation steps available - this issue does not have a released fix at the time of publication according to the official description
- Monitor the Appsmith GitHub repository (github.com/appsmithorg/appsmith) for security releases addressing this vulnerability
- Consider restricting network access to the Appsmith instance until a fix is available
- Review and audit publicly accessible Appsmith applications to understand potential exposure
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation12.0 h
- Implementation16.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,520.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-24042 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-24042 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data