Executive brief
Appsmith, a platform for building internal business tools, contains a security flaw in how it generates password reset and email verification links. If the platform is not specifically configured with a fixed base URL, an attacker can trick the system into sending legitimate-looking emails that contain links pointing to a malicious website. If a user clicks these links, the attacker can capture their security tokens and take over their account.
Technical details
Appsmith's password reset and email verification flows derive the base URL for generated links from the HTTP 'Origin' header. While validation exists, it is only enforced if the 'APPSMITH_BASE_URL' environment variable is explicitly set. If unset, the application defaults to a backward-compatibility mode that accepts any caller-supplied origin. An unauthenticated remote attacker can trigger these flows (via /api/v1/users/forgotPassword or /resendEmailVerification) with a forged Origin header. This results in the delivery of a legitimate email to a victim containing a token-bearing link hosted on an attacker-controlled domain. If the victim clicks the link, the sensitive token is leaked to the attacker. This issue is fixed in version 2.0.
Affected products
- Appsmith server < 2.0
Timeline
- 2026-05-21: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched