CVE-2026-34411

Katalog CVE

CVSS 5.3 · Medium EPSS 0,45%

Kerentanan Missing Authentication for Critical Function pada appsmith. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-qvvc-prjx-f85j exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/appsmith-unauthenticated-instance-configuration-disclosure-via-management... advisory pihak ketiga