Critical Appsmith Flaw CVE-2026-22794 Allows Account Takeover

A critical vulnerability has been discovered in Appsmith, the popular open-source platform used by organizations to build internal dashboards and admin panels. Tracked as CVE-2026-22794, the flaw carries a near-maximum CVSS score of 9.7, allowing remote attackers to hijack user accounts by simply manipulating a single HTTP header.

The vulnerability stems from a dangerous lack of validation in how the platform handles password reset and email verification requests. By exploiting this oversight, an attacker can trick the server into sending sensitive authentication tokens directly to a domain they control.

The core of the issue lies in how Appsmith generates links for emails. According to the disclosure, “The server uses the Origin value from the request headers as the email link baseUrl without validation”.

In a secure implementation, the server should rely on a fixed, trusted configuration for its domain name. However, the vulnerable versions of Appsmith blindly trust the Origin header provided in the incoming request. This means an attacker can send a password reset request for a victim’s email address but manipulate the header to point to a malicious site (e.g., https://attacker-controlled-site.com).

The exploitation process is alarmingly simple and requires no advanced access:

1. An attacker initiates a password reset for a target user but sets the Origin header to their own malicious domain .
2. The server generates a legitimate password reset token but constructs the link using the attacker’s domain as the base. The email sent to the victim looks like: https://[attacker-domain]/user/resetPassword?token=….
3. When the unsuspecting victim clicks the link in the official email, their browser sends a request to the attacker’s server, leaking the valid reset token.
4. Armed with the token, the attacker can reset the password and “gain access to the account”.

Because Appsmith is designed to connect to internal databases, APIs, and business logic, a compromised account can have devastating consequences. The report warns of Account Takeover, where attackers gain full control of the victim’s profile, and Personal Information Exposure, putting user data at risk.

Furthermore, the vulnerability opens the door to Phishing and Malicious Redirection, leveraging the trust users have in legitimate system emails to lure them into traps.

The vulnerability affects Appsmith version 1.92. The development team has released a fix in version 1.93, which properly validates the base URL generation .

Administrators running self-hosted instances of Appsmith are urged to upgrade immediately. Given the high CVSS score and the ease of exploitation, this vulnerability represents a significant risk to the internal security of organizations relying on the platform.

Related Posts:

• CVE-2024-55963: Appsmith’s Default PostgreSQL Misconfiguration Leads to RCE, PoC Releases
• Beyond HTML: The Hidden Danger of Phishing in HTTP Response Headers
• Multiple Security Vulnerabilities Plague PHP, Exposing Applications to Risk
• CISA Warns of Credential Risks Tied to Oracle Cloud Breach
• GitLab Patches High-Severity Flaws: Update Now to Prevent XSS and Account Takeover