Appsmith EUVD-2026-16721

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects low-complexity remote unauthenticated access with confidentiality impact but no integrity or availability impact, consistent with information disclosure. The vector confirms zero authentication requirements (PR:N) and low attack complexity (AC:L), making this accessible to any network-capable attacker without credentials or user interaction. The real-world risk is moderate to high for reconnaissance and attack planning: while the CVSS score of 5.3 falls in the medium range, the combination of unauthenticated access, network reachability, and disclosure of configuration and email domain hashes creates a clear attack precursor. An attacker can enumerate Appsmith instances, identify administrators by email domain, and gather licensing/version information to plan targeted phishing, credential stuffing, or supply-chain attacks. The absence of confirmed active exploitation (KEV status not provided) and public POC does not diminish this risk-authentication bypass vulnerabilities are among the most reliably exploitable and frequently automated by threat actors. Patch availability from the vendor reduces long-term risk for diligent operators but does not address legacy or unpatched instances.

An attacker performs network scanning or passive reconnaissance to identify publicly exposed Appsmith instances. Upon discovery, the attacker makes unauthenticated HTTP requests to /api/v1/tenants/current and /api/v1/consolidated-api/view, receiving unprotected configuration and licensing metadata without providing credentials. The attacker extracts unsalted SHA-256 hashes of admin email domains, identifies the Appsmith version, and uses this information to target administrators with phishing emails or attempt credential compromise via password spraying against known domains. This reconnaissance requires no specialized tools beyond curl or a browser, and AC:L confirms the attack requires minimal effort.