CVE-2024-55965

An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.

• CWE-863

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6Third Party Advisory

Published

Mar 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55957In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Ther…7.8
• CVE-2024-55958Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.2…4.8
• CVE-2024-55959Northern.tech Mender Client 4.x before 4.0.5 has Insecure Pe…9.1
• CVE-2024-5596The ARMember Premium plugin for WordPress is vulnerable to C…6.3
• CVE-2024-55963An issue was discovered in Appsmith before 1.51. A user on A…6.5
• CVE-2024-55964An issue was discovered in Appsmith before 1.52. An incorrec…9.8
• CVE-2024-55968An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1…8.8
• CVE-2024-55969DocIO in Syncfusion Essential Studio for ASP.NET MVC before …9.1
• CVE-2024-5597Fuji Electric Monitouch V-SFT is vulnerable to a type confus…9.8
• CVE-2024-55970File Manager in Syncfusion Essential Studio for ASP.NET MVC …7.5
• CVE-2024-55971SQL Injection vulnerability in the default configuration of …10
• CVE-2024-55972Improper Neutralization of Special Elements used in an SQL C…9.3