CVE-2026-30862 - Vulnerability Analysis

Overview

Appsmith < 1.96 contains a stored XSS caused by lack of HTML sanitization in TableWidgetV2 React component, letting attackers with regular user accounts force admin API calls and achieve full administrative takeover, exploit requires attacker to have a regular user account.

Severity & Score

Impact

Attackers can execute high-privileged API calls leading to full administrative account takeover.

Mitigation

Upgrade to version 1.96 or later.

References

• https://github.com/appsmithorg/appsmith/security/advisories/GHSA-5hw4-whxv-6794

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 10, 2026

⚠️ CRITICAL: CVE-2026-30862 in Appsmith <1.96 enables stored XSS via TableWidgetV2. Attackers can leverage 'Invite Users' for admin takeover. Patch to 1.96+ ASAP! No active exploits yet. https://radar.offseq.com/threat/cve-2026-30862-cwe-79-improper-neutralization-of-i-d918c60a #OffSeq #XSS #Appsmith #CVE2026_30862

View original post

GitHub Repositories(1 repo)

• https://github.com/drkim-dev/CVE-2026-30862

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner