Critical Stored XSS & Privilege Escalation in Appsmith

The impact of CVE-2026-30862 is severe. An attacker, even with a standard user account, can exploit this XSS vulnerability to gain complete control over the Appsmith instance. By leveraging the "Invite Users" feature, they can craft a malicious payload that, when processed by a System Administrator, executes a privileged API call (/api/v1/admin/env). This API call allows the attacker to modify system-level configurations and effectively assume the role of an administrator. The potential for data breaches, unauthorized access, and complete system compromise is significant. This vulnerability shares similarities with other XSS exploits where user-supplied data is improperly handled, leading to arbitrary code execution within the application’s context.

Organizations utilizing Appsmith for building internal tools and admin panels are at risk, particularly those with System Administrator accounts that are susceptible to social engineering attacks. Shared hosting environments where multiple users share an Appsmith instance are also at increased risk, as a compromised regular user account could potentially lead to administrative access.

• javascript / web:

// Check for suspicious API calls to /api/v1/admin/env in Appsmith logs
// Look for requests originating from unusual user accounts

• generic web:

curl -I 'https://<appsmith_instance>/api/v1/admin/env' | grep -i '200 OK'

• generic web:

# Check Appsmith access logs for POST requests to /api/v1/admin/env
# with unusual user agents or referrer headers

1. 2026-03-09Disclosure

   disclosure

1. Reserviert2026-03-05
2. Veröffentlicht2026-03-09
3. Geändert2026-03-10
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-30862 is to immediately upgrade Appsmith to version 1.96 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data used within the Table Widget. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block XSS payloads targeting the /api/v1/admin/env endpoint can provide a temporary layer of defense. Regularly review and audit Appsmith configurations, paying close attention to user permissions and access controls. After upgrading, confirm the fix by attempting to trigger the vulnerable API call with a known malicious payload and verifying that it is properly sanitized.