CVE-2026-22794
CriticalSummary
Vulnerability in Appsmith before 1.93: the server uses the Origin header value as the email link baseUrl without validation. An attacker controlling Origin can cause password reset / email verification links to point to their domain, exposing authentication tokens and potentially leading to account takeover.
Risk Assessment
Possible account takeover, leading to unauthorized access to data and system integrity compromise.
Recommendation
Update Appsmith to version 1.93 or later, which includes the fix.
Original NVD description (English source)
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.