What is the CVSS score of CVE-2026-22794?

CVE-2026-22794 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Appsmith are affected by CVE-2026-22794?

Organizations using Appsmith face critical risk from CVE-2026-22794 rated CVSS 9.6.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22794?

Yes, a public proof-of-concept exploit is available for CVE-2026-22794. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22794?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Appsmith CVE-2026-22794

CRITICAL

Origin Validation Error (CWE-346)

2026-01-12 security-advisories@github.com

CSRF Appsmith

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 21, 2026 - 19:14 vuln.today

Public exploit code

Patch released

Jan 21, 2026 - 19:14 nvd

Patch available

CVE Published

Jan 12, 2026 - 22:16 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.

AnalysisAI

Appsmith before 1.93 allows attackers to control the Origin header value used as the base URL in password reset and email verification links. Attackers can redirect authentication tokens to their domain, enabling account takeover. PoC available, patch available.

Technical ContextAI

The server uses the Origin header from requests as the base URL for password reset and email verification links (CWE-346). An attacker sets the Origin to their domain, causing the victim to receive a legitimate-looking email with links pointing to the attacker's server, which captures the authentication tokens.