CVE-2026-5418

{"id": "CVE-2026-5418", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5418", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T12:59:49.042923Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*"], "vendor": "appsmithorg", "modules": ["Dashboard"], "product": "appsmith", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}, {"status": "affected", "version": "1.4"}, {"status": "affected", "version": "1.5"}, {"status": "affected", "version": "1.6"}, {"status": "affected", "version": "1.7"}, {"status": "affected", "version": "1.8"}, {"status": "affected", "version": "1.9"}, {"status": "affected", "version": "1.10"}, {"status": "affected", "version": "1.11"}, {"status": "affected", "version": "1.12"}, {"status": "affected", "version": "1.13"}, {"status": "affected", "version": "1.14"}, {"status": "affected", "version": "1.15"}, {"status": "affected", "version": "1.16"}, {"status": "affected", "version": "1.17"}, {"status": "affected", "version": "1.18"}, {"status": "affected", "version": "1.19"}, {"status": "affected", "version": "1.20"}, {"status": "affected", "version": "1.21"}, {"status": "affected", "version": "1.22"}, {"status": "affected", "version": "1.23"}, {"status": "affected", "version": "1.24"}, {"status": "affected", "version": "1.25"}, {"status": "affected", "version": "1.26"}, {"status": "affected", "version": "1.27"}, {"status": "affected", "version": "1.28"}, {"status": "affected", "version": "1.29"}, {"status": "affected", "version": "1.30"}, {"status": "affected", "version": "1.31"}, {"status": "affected", "version": "1.32"}, {"status": "affected", "version": "1.33"}, {"status": "affected", "version": "1.34"}, {"status": "affected", "version": "1.35"}, {"status": "affected", "version": "1.36"}, {"status": "affected", "version": "1.37"}, {"status": "affected", "version": "1.38"}, {"status": "affected", "version": "1.39"}, {"status": "affected", "version": "1.40"}, {"status": "affected", "version": "1.41"}, {"status": "affected", "version": "1.42"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.46"}, {"status": "affected", "version": "1.47"}, {"status": "affected", "version": "1.48"}, {"status": "affected", "version": "1.49"}, {"status": "affected", "version": "1.50"}, {"status": "affected", "version": "1.51"}, {"status": "affected", "version": "1.52"}, {"status": "affected", "version": "1.53"}, {"status": "affected", "version": "1.54"}, {"status": "affected", "version": "1.55"}, {"status": "affected", "version": "1.56"}, {"status": "affected", "version": "1.57"}, {"status": "affected", "version": "1.58"}, {"status": "affected", "version": "1.59"}, {"status": "affected", "version": "1.60"}, {"status": "affected", "version": "1.61"}, {"status": "affected", "version": "1.62"}, {"status": "affected", "version": "1.63"}, {"status": "affected", "version": "1.64"}, {"status": "affected", "version": "1.65"}, {"status": "affected", "version": "1.66"}, {"status": "affected", "version": "1.67"}, {"status": "affected", "version": "1.68"}, {"status": "affected", "version": "1.69"}, {"status": "affected", "version": "1.70"}, {"status": "affected", "version": "1.71"}, {"status": "affected", "version": "1.72"}, {"status": "affected", "version": "1.73"}, {"status": "affected", "version": "1.74"}, {"status": "affected", "version": "1.75"}, {"status": "affected", "version": "1.76"}, {"status": "affected", "version": "1.77"}, {"status": "affected", "version": "1.78"}, {"status": "affected", "version": "1.79"}, {"status": "affected", "version": "1.80"}, {"status": "affected", "version": "1.81"}, {"status": "affected", "version": "1.82"}, {"status": "affected", "version": "1.83"}, {"status": "affected", "version": "1.84"}, {"status": "affected", "version": "1.85"}, {"status": "affected", "version": "1.86"}, {"status": "affected", "version": "1.87"}, {"status": "affected", "version": "1.88"}, {"status": "affected", "version": "1.89"}, {"status": "affected", "version": "1.90"}, {"status": "affected", "version": "1.91"}, {"status": "affected", "version": "1.92"}, {"status": "affected", "version": "1.93"}, {"status": "affected", "version": "1.94"}, {"status": "affected", "version": "1.95"}, {"status": "affected", "version": "1.96"}, {"status": "affected", "version": "1.97"}, {"status": "unaffected", "version": "1.99"}]}]}], "published": "2026-04-02T19:21:36.737", "references": [{"url": "https://github.com/appsmithorg/appsmith/", "source": "cna@vuldb.com"}, {"url": "https://github.com/appsmithorg/appsmith/security/advisories/GHSA-9m89-5jw7-q5cr", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/780190", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/354855", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/354855/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en appsmithorg appsmith hasta la versi\u00f3n 1.97. Afectada est\u00e1 la funci\u00f3n computeDisallowedHosts del archivo app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java del componente Dashboard. Dicha manipulaci\u00f3n conduce a falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque puede ser lanzado remotamente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser usado. La actualizaci\u00f3n a la versi\u00f3n 1.99 es recomendada para abordar este problema. El componente afectado deber\u00eda ser actualizado. El proveedor fue contactado tempranamente, respondi\u00f3 de una manera muy profesional y r\u00e1pidamente lanz\u00f3 una versi\u00f3n corregida del producto afectado."}], "lastModified": "2026-07-24T20:10:00.147", "sourceIdentifier": "cna@vuldb.com"}