CVE-2026-22794

critical · 9.6

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.

9.6

CVSS

0.4%

EPSS (exploit prob.)

33rd

EPSS percentile

2026-01-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-346

Affected products

Vendor	Product	Affected versions
appsmith	appsmith	< 1.93

Check a specific version with /api/v1/cve/match.

References

https://github.com/appsmithorg/appsmith/commit/6f9ee6226bac13fb4b836940b557913fff78b633
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv
https://github.com/appsmithorg/appsmith/security/advisories/GHSA-7hf5-mc28-xmcv

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-22794