CVE-2026-22794

Katalog CVE

CVSS 8.8 · High EPSS 0,39%

Kerentanan Origin Validation Error pada appsmith. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.

Rincian

Terbit di NVD

12 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv exploit · advisory vendor
• https://github.com/appsmithorg/appsmith/commit/6f9ee6226bac13fb4b836940b557913fff78b633 patch