appsmith vulnerabilities (Bitnami)
19 vulnerabilities.
-
appsmithBitnami Appsmith: Caddy admin API exposed without authentication 9.9 Critical -
appsmithBitnami Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist 5.3 Medium -
appsmithBitnami Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route 8.9 High -
appsmithBitnami Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter 5.1 Medium -
appsmithBitnami CVE-2026-7299 6.3 Medium -
appsmithBitnami Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs 6.9 Medium -
appsmithBitnami Critical Stored XSS & Privilege Escalation in Appsmith 9.1 Critical -
appsmithBitnami Appsmith public apps can execute unpublished actions (viewMode confusion) 9.4 Critical -
appsmithBitnami Account Takeover Vulnerability in Appsmith 9.7 Critical -
appsmithBitnami Mounted Kubernetes Secrets under a predictable path located within the web server document root 10.0 Critical -
appsmithBitnami An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacke… 9.8 Critical -
appsmithBitnami An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Apps… 6.5 Medium -
appsmithBitnami An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have... 6.5 Medium -
appsmithBitnami Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources 4.8 Medium -
appsmithBitnami AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests... 8.5 High -
appsmithBitnami Server-Side Request Forgery (SSRF) in appsmithorg/appsmith 8.8 High -
appsmithBitnami An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed... 4.3 Medium -
appsmithBitnami Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side... 8.8 High -
appsmithBitnami Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute... 8.9 High