Executive brief
Appsmith, a platform used to build internal business tools, contains a security flaw where sensitive system information is accessible to anyone on the network without a password. An attacker can view details about the organization's license, active security features like Single Sign-On (SSO), and internal configuration settings. This information acts as a blueprint for more advanced targeted attacks or data breaches by revealing exactly how the system is protected and who manages it.
Technical details
Appsmith versions prior to 1.98 suffer from a missing authentication vulnerability (CWE-306) in several management API endpoints, including /api/v1/consolidated-api/view, /api/v1/users/features, and /api/v1/tenants/current. These endpoints, intended for internal application performance monitoring, are accessible to unauthenticated network attackers. Exploitation allows the retrieval of sensitive metadata such as license plans, instance IDs, session timeouts, and unsalted SHA-256 hashes of administrator email domains. The admin domain hashes are particularly vulnerable to brute-force attacks using commodity hardware, enabling attackers to identify the specific organization operating the instance and plan further targeted exploits based on the revealed security posture (e.g., SAML, OIDC, or SCIM status). The issue is resolved in version 1.98.
Affected products
- Appsmith Appsmith < 1.98
Timeline
- 2026-03-26: advisory: GitHub Security Advisory published by Appsmith team
- 2026-03-27: disclosed: CVE-2026-34411 published to NVD
- 2026-03-27: patched: Fix confirmed available in version 1.98