CVE-2026-34411

MEDIUM 5.3

Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains for reconnaissance and targeted attack planning.

CWE	CWE-306
Vendor	appsmith
Product	appsmith
Published	Mar 27, 2026
Last Updated	Mar 27, 2026

Stay Ahead of the Next One

Get instant alerts for appsmith appsmith

Be the first to know when new medium vulnerabilities affecting appsmith appsmith are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Appsmith / Appsmith

0 < 1.98.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/appsmithorg/appsmith/security/advisories/GHSA-qvvc-prjx-f85j vulncheck.com: https://www.vulncheck.com/advisories/appsmith-unauthenticated-instance-configuration-disclosure-via-management-apis

Credits

Neo by ProjectDiscovery (https://neo.projectdiscovery.io)