FKIE_CVE-2026-30862

Vulnerability from fkie_nvd - Published: 2026-03-10 17:40 - Updated: 2026-03-13 15:34
Severity ?
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Summary
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
References
security-advisories@github.comhttps://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794Exploit, Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
appsmith appsmith *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB36CCD5-B655-45E3-97B3-FC5FC2B79B6B",
              "versionEndExcluding": "1.96",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the \"Invite Users\" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96."
    },
    {
      "lang": "es",
      "value": "Appsmith es una plataforma para construir paneles de administraci\u00f3n, herramientas internas y cuadros de mando. Anterior a la 1.96, existe una vulnerabilidad XSS Almacenado Cr\u00edtica en el Widget de Tabla (TableWidgetV2). La causa ra\u00edz es una falta de saneamiento de HTML en el pipeline de renderizado de componentes de React, permitiendo que atributos maliciosos sean interpolados en el DOM. Aprovechando la caracter\u00edstica \u0027Invitar Usuarios\u0027, un atacante con una cuenta de usuario regular (user@gmail.com) puede forzar a un Administrador del Sistema a ejecutar una llamada a la API con altos privilegios (/api/v1/admin/env), resultando en una Toma de Control Completa de la Cuenta Administrativa. Esta vulnerabilidad est\u00e1 corregida en la 1.96."
    }
  ],
  "id": "CVE-2026-30862",
  "lastModified": "2026-03-13T15:34:16.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-10T17:40:14.123",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.