Critical · published January 22, 2026
🚨 A simple toggle is all it takes for an attacker to access edit-mode actions on your Appsmith applications! 🔥 Think of it like a restaurant where anyone can walk right into the kitchen by just saying 'I'm here for a tasting!' — suddenly, they can whip up any dish, even the uncooked ones! An attacker can exploit this vulnerability to unleash sensitive data, execute untested actions, and access development resources. This could lead to all sorts of chaos, from leaking confidential information to executing harmful commands that could disrupt your operations and compromise your dashboards.
Think of it like a restaurant where anyone can walk right into the kitchen by just saying 'I'm here for a tasting!' — suddenly, they can whip up any dish, even the uncooked ones! In versions 1.94 and below of Appsmith, unauthenticated users can bypass the necessary checks by sending a simple parameter (viewMode=false) in their POST requests, allowing them to execute unpublished actions.
An attacker can exploit this vulnerability to unleash sensitive data, execute untested actions, and access development resources. This could lead to all sorts of chaos, from leaking confidential information to executing harmful commands that could disrupt your operations and compromise your dashboards. Immediately restrict access to your Appsmith instances and ensure that only authenticated users can send requests to the /api/v1/actions/execute endpoint. Keep an eye out for any patches that may be released to address this critical issue. You've got this! Stay proactive and safeguard your applications from potential threats! 🛡️