CVE-2026-24042: Appsmith public apps can execute unpublished actions (viewMode confusion)
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24042?
CVE-2026-24042 has been classified as a critical vulnerability due to its potential for unauthorized execution of unpublished actions.
How do I fix CVE-2026-24042?
To mitigate CVE-2026-24042, upgrade Appsmith to version 1.95 or later where this issue has been addressed.
Who is affected by CVE-2026-24042?
Users of Appsmith versions 1.94 and below with publicly accessible apps are vulnerable to CVE-2026-24042.
What type of vulnerability is CVE-2026-24042?
CVE-2026-24042 is categorized as an issue related to viewMode confusion allowing unauthorized action execution.
What actions can unauthenticated users execute due to CVE-2026-24042?
Due to CVE-2026-24042, unauthenticated users can execute unpublished actions that should only be available in edit mode.