Description

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.

INFO

Published Date :

2026-01-12T21:54:52.803Z

Last Modified :

2026-01-12T21:54:52.803Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-22794 vulnerability.

Vendors Products
Appsmith
  • Appsmith
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-22794.

URL Resource
https://github.com/appsmithorg/appsmith/commit/6f9ee6226bac13fb4b836940b557913fff78b633 cve-icon cve-icon
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact