Appsmith Community Edition race condition in super user creation

Executive brief

Appsmith is a platform used to build internal business tools. A flaw in its initial setup process allows an attacker to create a secret administrator account by sending multiple simultaneous requests before the legitimate owner finishes setting up the system. If exploited, an attacker gains full control over the platform, including the ability to access sensitive database credentials, modify applications, and manage all user accounts.

Technical details

A Time-of-Check-Time-of-Use (TOCTOU) race condition exists in the 'signupAndLoginSuper()' method within 'UserSignupCEImpl.java'. The application performs a non-atomic check to see if any users exist before creating the first 'super user' (Instance Administrator). Because this check and the subsequent user creation are not wrapped in a database transaction or protected by a distributed lock, concurrent POST requests to '/api/v1/users/super' can bypass the single-admin restriction. An unauthenticated remote attacker can exploit this during the brief window when a new instance is deployed but not yet configured, resulting in persistent full administrative access. The vulnerability is addressed in version 1.99.0.

Affected products

• Appsmith Appsmith Community Edition < 1.99.0

Timeline

• 2026-05-21: disclosed
• 2026-05-21: patched: Version 1.99.0 released
• 2026-06-12: advisory

References

• https://api.github.com/users/Moonster8282
• https://github.com/Moonster8282
• https://api.github.com/users/Moonster8282/gists%7B/gist_id%7D
• https://api.github.com/users/Moonster8282/repos
• https://avatars.githubusercontent.com/u/150594089?v=4
• https://api.github.com/users/Moonster8282/events%7B/privacy%7D