Appsmith
CVE-2026-22794
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTTP request with malicious Origin header
-
DeliveryServer generates password reset email with attacker-controlled domain link
-
ExploitUser clicks email link
-
ExecutionAuthentication token exposed to attacker
-
ImpactAccount takeover achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Appsmith versions prior to 1.93 with email-based password reset or verification enabled. Attacker must control Origin header in HTTP request; victim must click malicious email link sent by legitimate Appsmith instance. |
| Impact | CVSS 9.6 (Critical). No auth (attacker initiates reset), user interaction required (clicking link), scope change. PoC available. EPSS 0.02%. Patch available. |
| Exploit ScenarioDerived | An attacker sends a password reset request for a target user with Origin: https://evil.com. The user receives a reset email with evil.com links. Clicking the link sends the reset token to the attacker, who uses it to reset the password. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Appsmith before 1.93 allows attackers to control the Origin header value used as the base URL in password reset and email verification links. Attackers can redirect authentication tokens to their domain, enabling account takeover. PoC available, patch available.
Earlier versions of this analysis (1)
Appsmith uses unvalidated Origin header as email link base URL, enabling token theft and account takeover.
RemediationAI
Update to Appsmith 1.93 or later.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The server uses the Origin header from requests as the base URL for password reset and email verification links (CWE-346). An attacker sets the Origin to their domain, causing the victim to receive a legitimate-looking email with links pointing to the attacker's server, which captures the authentication tokens.
Know when Appsmith gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.
Executive ViewAI
Organizations using Appsmith face critical risk from CVE-2026-22794 rated CVSS 9.6. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)GitHub Advisory
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2. Rated medium severity (CVSS
Reverse-proxy takeover in Appsmith versions prior to 2.1 lets an authenticated low-privileged user abuse server-side req
Server-side request forgery (SSRF) in Appsmith Dashboard component allows unauthenticated remote attackers to manipulate
Appsmith platform version 1.94 and below has a missing authorization vulnerability that allows unauthenticated access to
Stored XSS in Appsmith's SQL query editor autocomplete allows an authenticated Developer-role user to inject persistent
Appsmith platform prior to version 1.96 has a critical stored XSS enabling account takeover through crafted admin panel
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands insid
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via re
Appsmith versions prior to 1.98 allow unauthenticated remote attackers to access sensitive instance management API endpo
Exploit-DB