Appsmith Information Disclosure Vulnerability for App Viewers

A vulnerability exists in Appsmith versions through 1.50, allowing users with the 'App Viewer' role to access development information, specifically a list of datasources, within workspaces they belong to. This access does not include sensitive data such as database passwords or API keys. The issue arises from improper access controls that permit viewers to query datasource information, which should be restricted.

Impact

Exploitation of this vulnerability leads to unauthorized access to datasource information within a workspace, although no sensitive data is exposed.

Remediation

Users can upgrade to Appsmith version 1.51 or later to address this vulnerability.