CVE-2026-24042 is a critical missing authorization flaw (CVSS 9.4) in Appsmith 1.94 and below. On a public app, anonymous users can execute unpublished edit-mode actions through the actions execute API. The advisory now lists 1.95 as patched. Upgrade, and review which apps are public.
What's affected
Appsmith 1.94 and below. The NVD record says no fix was released at publication. The GitHub advisory page now lists v1.95 as the patched version, so verify that on the advisory and in your release notes before relying on it.
The advisory states a precondition: the app is published and made public.
How to check if you're exposed
List the apps in your workspace that are set to public. Then check your version in the Appsmith admin settings or from the image tag:
docker ps --format "table {{.Names}}\t{{.Image}}"
An instance on 1.94 or below with any public app is exposed. Also think about what the edit-mode actions connect to: development databases, test APIs, and sometimes production ones.
What to do now
- Upgrade to the patched release named in the advisory (1.95 at the time of reading).
- Until you can, set public apps to private or restrict them with authentication.
- Review the data sources and APIs that actions use, and make sure development queries do not point at production data.
- Check access logs for calls to the actions execute endpoint with the view mode parameter set to false or omitted from anonymous sessions.
- Rotate credentials stored in datasource configurations if you find suspicious calls.
Why it matters
The weakness is CWE-862, missing authorization. The publish boundary is a promise: viewers only get what was published. Here the server trusted a client-supplied flag to decide whether to run the published or the edit-mode version.
The impact listed by the advisory includes data exposure, running edit-mode queries and APIs, access to development data, and side effects such as writes or external API calls. Internal tool builders often connect powerful credentials, which is why this reaches further than a typical web app bug. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.4, published 2026-01-22. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability low.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Low code platforms connect to databases and internal APIs with powerful credentials, so review the credentials as well as the platform. Give each data source a least privilege account, keep separate development and production data sources, and make sure edit-mode actions never point at production. Audit which apps are public, and require login for internal tools by default. Keep an inventory of datasources so a platform flaw can be assessed quickly.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is an app safe if it requires login?
The precondition in the advisory is a public app. An app that requires login is outside that stated condition, but still upgrade.
Sources
Last reviewed: 19 October 2026.
