What’s Vulnerable › Vulnerabilities

CVE-2026-22794: Account Takeover Vulnerability in Appsmith

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-12 · updated 2026-06-17
• Weakness: CWE-346

Description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.

Affected products

• appsmithorg appsmith: before 1.93 — fixed in 1.93

How to fix

Upgrade to a fixed version: appsmithorg appsmith 1.93. Check the vendor advisory for mitigations.

References

• https://github.com/appsmithorg/appsmith/commit/6f9ee6226bac13fb4b836940b557913fff78b633
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv

Get alerted when CVE-2026-22794 or the next vulnerability affects your stack