VulnSocial

CVE-2026-30862Disclosure(appsmith / appsmith)

LOWCVSS 9.0 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account ([email protected]) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.

appsmith CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • appsmith

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-10)
  • 3 total mentions across 2 days

Affected systems

Vendors
appsmith
Products
appsmith

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-09: 1Mentions · 2026-03-10: 2Technical Details · 2026-03-09: 1Technical Details · 2026-03-10: 203-0903-10
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-091
Disclosure1
2026-03-102
Disclosure2
Full discourse3 posts
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2026-30862 - Critical Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause... https://www.thehackerwire.com/vulnerability/CVE-2026-30862/ https://t.co/0zIZwOY1hM

    Post summary

    The text announces a critical stored XSS vulnerability (CVE-2026-30862) in Appsmith’s Table Widget and links to an external article for more details.

    0000024
    133 followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-30862: CRITICAL] Critical Stored XSS vulnerability in Appsmith's TableWidgetV2 pre-1.96 version allows attackers to execute high-privileged API calls and gain full administrative account access. Up...#cve,CVE-2026-30862,#cybersecurity https://cvefind.com/CVE-2026-30862

    Post summary

    This post discloses a critical stored XSS flaw in Appsmith's TableWidgetV2 that enables attackers to gain full administrative access, yet it provides no PoC, exploit, or patch details.

    0000032
    601 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-30862: Critical Stored XSS & Privilege ... React component bypasses HTML sanitization to weaponize Table Widget invites into admin API takeovers—classic DOM injec... https://zerodaysignal.com/vulnerability/CVE-2026-30862 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post announces a critical stored XSS vulnerability in a React component that can bypass sanitization and enable admin API takeovers, providing initial technical details without any PoC, exploit code, patch, or active exploitation evidence.

    0000065
    140 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appappsmithappsmith---

Explore more

Back to dashboardappsmith CVEsappsmith vulnerabilities