CVE-2026-30862: Critical Stored XSS & Privilege Escalation in Appsmith
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30862?
CVE-2026-30862 is classified as a critical vulnerability due to its potential for stored XSS and privilege escalation.
How do I fix CVE-2026-30862?
To mitigate CVE-2026-30862, users should upgrade to Appsmith version 1.96 or later, where the vulnerability has been addressed.
What are the impacts of CVE-2026-30862?
CVE-2026-30862 can lead to unauthorized access and manipulation of data due to the stored XSS vulnerability.
Where is CVE-2026-30862 found?
CVE-2026-30862 affects the Table Widget (TableWidgetV2) component of Appsmith prior to version 1.96.
Is CVE-2026-30862 related to any other vulnerabilities?
CVE-2026-30862 is specifically related to a lack of HTML sanitization and is considered a significant threat in the context of web application security.