Appsmith Information Disclosure Vulnerability for App Viewers

A vulnerability in Appsmith versions through 1.50 allows users with the 'App Viewer' role to access a list of datasources in their workspace. This access violates the intended permissions for viewers, who should not have visibility into development components. While the vulnerability does not expose sensitive information such as database passwords or API keys, it still represents an unauthorized access issue. To exploit this vulnerability, a user must be invited to a workspace as a viewer and have the ability to sign up or log in to the Appsmith instance.

Impact

Exploitation of this vulnerability leads to unauthorized information disclosure, allowing viewers to access datasource lists in their workspaces.

Remediation

Users can upgrade to Appsmith version 1.51 or later to address this vulnerability. No additional workarounds are available.