CVE-2026-24042
Published: 22 January 2026
Summary
CVE-2026-24042 is a critical-severity Missing Authorization (CWE-862) vulnerability in Appsmith Appsmith. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-22 (Publicly Accessible Content).
Deeper analysis
CVE-2026-24042 is a missing authorization vulnerability (CWE-862) affecting Appsmith, an open-source platform for building admin panels, internal tools, and dashboards, in versions 1.94 and below. The flaw occurs in publicly accessible apps, where unauthenticated users can execute unpublished edit-mode actions by sending a POST request to /api/v1/actions/execute with the parameter viewMode=false or by omitting it entirely. This circumvents the intended publish boundary, which restricts public viewers to only published actions and excludes edit-mode versions. The vulnerability carries a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating high confidentiality, integrity, and limited availability impact.
Any unauthenticated attacker with network access can exploit this issue against affected Appsmith instances hosting public apps. Exploitation requires only crafting and sending the manipulated POST request, enabling execution of edit-mode queries and APIs. Successful attacks can lead to sensitive data exposure, access to development data, and triggering of side-effect behaviors such as unintended API calls or data modifications.
The GitHub Security Advisory (GHSA-j9qq-4fj9-9883) confirms no fix has been released as of the CVE publication date. Security practitioners should monitor Appsmith's official channels for patches, restrict public app exposure where possible, and implement network-level controls to block unauthorized API access until remediation is available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4221
Vulnerability details
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the…
more
expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a missing authorization flaw in a public-facing Appsmith application, allowing unauthenticated remote exploitation via crafted API requests, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 identifies and authorizes specific actions without identification or authentication, directly preventing unauthenticated execution of unpublished edit-mode actions.
AC-3 enforces approved authorizations for logical access, mitigating the missing authorization that allows bypassing publish boundaries.
AC-22 restricts access to publicly accessible content, tailored to prevent over-privileged access in public Appsmith applications.