CVE-2026-30862

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user account (user@gmail.com) can force a System Administrator to execute a high-privileged API call (/api/v1/admin/env), resulting in a Full Administrative Account Takeover. This vulnerability is fixed in 1.96.

• CWE-79

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794Exploit, Mitigation, Vendor Advisory
• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794Exploit, Mitigation, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30857WeKnora is an LLM-powered framework designed for deep docume…5.3
• CVE-2026-30858WeKnora is an LLM-powered framework designed for deep docume…7.5
• CVE-2026-30859WeKnora is an LLM-powered framework designed for deep docume…6.5
• CVE-2026-3086GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code…7.8
• CVE-2026-30860WeKnora is an LLM-powered framework designed for deep docume…9.8
• CVE-2026-30861WeKnora is an LLM-powered framework designed for deep docume…8.8
• CVE-2026-30863Parse Server is an open source backend that can be deployed …9.8
• CVE-2026-30867CocoaMQTT is a MQTT 5.0 client library for iOS and macOS wri…6.5
• CVE-2026-30868OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-30869SiYuan is a personal knowledge management system. Prior to 3…9.8
• CVE-2026-3087If `shutil.unpack_archive()` is given a ZIP archive with an …7.5
• CVE-2026-30870PowerSync Service is the server-side component of the PowerS…6.5