Appsmith Community Edition race condition in super user creation

Severity: high · CVSS 8.1 · Published 2026-06-12

Appsmith is a platform used to build internal business tools. A flaw in its initial setup process allows an attacker to create a secret administrator account by sending multiple simultaneous requests before the legitimate owner finishes setting up the system. If exploited, an attacker gains full control over the platform, including the ability to access sensitive database credentials, modify applications, and manage all user accounts.

Technologies: Appsmith Community Edition. Vendors: Appsmith, Maven.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.1, published 12 June 2026.
Which products and versions are affected?
Appsmith Community Edition < 1.99.0; com.appsmith:server (Maven) < 1.99.0.
Is there a fix for This vulnerability?
A patch was published on 2026-05-21: Version 1.99.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a network appliance.
Am I affected?
Check whether you run Appsmith Community Edition or com.appsmith:server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check-Time-of-Use (TOCTOU) race condition exists in the 'signupAndLoginSuper()' method within 'UserSignupCEImpl.java'. The application performs a non-atomic check to see if any users exist before creating the first 'super user' (Instance Administrator). Because this check and the subsequent user creation are not wrapped in a database transaction or protected by a distributed lock, concurrent POST requests to '/api/v1/users/super' can bypass the single-admin restriction. An unauthenticated remote attacker can exploit this during the brief window when a new instance is deployed but not yet configured, resulting in persistent full administrative access. The vulnerability is addressed in version 1.99.0.

Affected products

  • Appsmith Appsmith Community Edition < 1.99.0

Timeline

  • 2026-05-21: disclosed
  • 2026-05-21: patched: Version 1.99.0 released
  • 2026-06-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.