CVE-2026-24042

{"id": "CVE-2026-24042", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24042", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T12:27:45.874857Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "appsmithorg", "product": "appsmith", "versions": [{"status": "affected", "version": "<= 1.94"}]}]}], "published": "2026-01-22T04:16:00.187", "references": [{"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-j9qq-4fj9-9883", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit\u2011mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication."}, {"lang": "es", "value": "Appsmith es una plataforma para construir paneles de administraci\u00f3n, herramientas internas y paneles de control. En las versiones 1.94 e inferiores, las aplicaciones de acceso p\u00fablico permiten a usuarios no autenticados ejecutar acciones no publicadas (en modo edici\u00f3n) enviando viewMode=false (o omiti\u00e9ndolo) a POST /API/v1/actions/execute. Esto elude el l\u00edmite de publicaci\u00f3n esperado donde los espectadores p\u00fablicos solo deber\u00edan ejecutar acciones publicadas, no versiones en modo edici\u00f3n. Un ataque puede resultar en exposici\u00f3n de datos sensibles, ejecuci\u00f3n de consultas y API en modo edici\u00f3n, acceso a datos de desarrollo y la capacidad de desencadenar comportamientos con efectos secundarios. Este problema no tiene una soluci\u00f3n publicada en el momento de la publicaci\u00f3n."}], "lastModified": "2026-06-17T10:22:30.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0D385D9-E0EC-4CED-AB28-87B2CD03C5E8", "versionEndIncluding": "1.94"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}