CVE-2024-55604

Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.

• CWE-280

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6Vendor Advisory

Published

Mar 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55597A improper limitation of a pathname to a restricted director…7.2
• CVE-2024-55599An Improperly Implemented Security Check for Standard vulner…5.3
• CVE-2024-5560CWE-125: Out-of-bounds Read vulnerability exists that could …7.5
• CVE-2024-55601Hugo is a static site generator. Starting in version 0.123.0…5.3
• CVE-2024-55602PwnDoc is a penetration test report generator. Prior to comm…8.5
• CVE-2024-55603Kanboard is project management software that focuses on the …6.5
• CVE-2024-55605Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-5561The Popup Maker WordPress plugin before 1.19.1 does not san…4.8
• CVE-2024-55626Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2024-55627Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-55628Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-55629Suricata is a network Intrusion Detection System, Intrusion …7.5