Appsmith Unauthenticated Action Execution Vulnerability in Public Apps

A vulnerability in Appsmith versions through 1.94 allows unauthenticated users to execute unpublished (edit-mode) actions in publicly accessible apps. This is achieved by sending viewMode=false or omitting the viewMode parameter in POST requests to /api/v1/actions/execute. This behavior bypasses the intended publish boundary, which restricts public viewers to executing only published actions. The vulnerability could lead to unauthorized execution of edit-mode queries and APIs, access to development data, triggering of side effects such as write operations or external API calls, and exposure of sensitive data from unpublished actions.

Impact

Exploitation of this vulnerability allows for unauthorized execution of edit-mode actions, access to sensitive development data, and the ability to trigger side effects such as write operations or external API calls.