CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)

Critical 9.4 Published 22 Jan 2026 Updated 22 Jan 2026

Unauthenticated attackers can execute unpublished edit-mode actions in public Appsmith apps, leading to sensitive data exposure and unauthorized code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24042?

CVE-2026-24042 is a critical missing authorization vulnerability in appsmithorg appsmith, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.

Weakness: CWE-862

Which versions are affected by CVE-2026-24042?

1 open source package ship an affected version, including appsmith. It affects 1 product.

Package	Affected	Fixed in
`appsmith` Bitnami	All versions	`1.95.0`

Products include Appsmith Appsmith.

How do I fix CVE-2026-24042?

Upgrade appsmith to 1.95.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24042 being exploited?

There is no known exploitation of CVE-2026-24042 in the wild and no public exploit code.

Sources

Also known as BIT-appsmith-2026-24042, GHSA-j9qq-4fj9-9883.