Loading story…
A critical vulnerability in Appsmith tracked as CVE-2026-24042 (CVSS 9.4) allows unauthenticated users to execute unpublished (edit-mode) actions in publicly accessible Appsmith applications. The issue is described as a viewMode confusion flaw: public viewers should only be able to run published actions, but an attacker can bypass this boundary by sending viewMode=false (or omitting the parameter) when calling POST /api/v1/actions/execute.
Successful exploitation can expose sensitive development logic and data by enabling execution of edit-mode queries/APIs that were not intended for public use, including potential access to development data sources. Reported impacts include data leakage and the ability to trigger side effects such as write operations or external API calls. Affected versions are reported as Appsmith 1.94 and below, and at the time of reporting one source indicated no released fix yet.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
By the time of later reporting, Appsmith had released a fix for CVE-2026-24042 and advised users to upgrade to version 1.95 or later. This changed the status from an unfixed critical disclosure to a patched vulnerability.
Appsmith versions 1.94 and below were found to contain an access-control issue in publicly accessible apps that lets unauthenticated users execute unpublished edit-mode actions by setting viewMode=false or omitting the parameter on the actions execution endpoint. The flaw could expose sensitive data, trigger edit-mode queries and APIs, and cause unintended side effects.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OWASP's **API Security Top 10** identifies broken object-level and function-level authorization, excessive data exposure, security misconfiguration, and unsafe trust boundaries as leading API risks, warning that business logic abuse and operational gaps often turn ordinary endpoints into high-impact exposures. Those patterns were reflected in newly disclosed incidents involving both enterprise software and consumer-facing platforms, where low-privileged access was enough to reach data and functions intended for administrators or other users. In **CVE-2026-46515**, Frogman versions before `1.6.3` allowed users with only `PERM_READ` privileges to access administrative PBX data through MCP and HTTP APIs, including AMI manager secrets, outbound dial PINs, SIP secrets, backup paths, CDR history, and even root SSH connection commands; the flaw also enabled arbitrary execution of saved GraphQL queries and was rated **CVSS 9.3**. Separately, a bug bounty report on Target's Academy platform showed how two seemingly low-risk APIs could be chained to enumerate users and expose PII at scale, underscoring how weak authorization controls across interconnected endpoints can escalate routine API functionality into serious data disclosure.
Jul 19, 2026
Paperclip, an open-source control plane for AI agent teams, patched a **critical authorization bypass** tracked as `CVE-2026-41679` that could let a remote attacker self-register on exposed instances, obtain board-level API access, and execute arbitrary commands on the host running the service. The issue affected network-accessible deployments using Paperclip’s default authenticated-mode configuration, where missing authorization checks allowed an attacker to create and approve a CLI challenge, gain a persistent credential, and abuse a company import path that should have been restricted to instance administrators. By importing a crafted `.paperclip.yaml` file, an attacker could define an agent and command that would be executed by a host-level adapter with the permissions of the Paperclip server process. Paperclip also fixed two additional flaws reported by Oasis Security: `GHSA-x8hx-rhr2-9rf7`, a DNS rebinding issue in default `local_trusted` mode that could enable local command execution on developer machines, and `GHSA-xfqj-r5qw-8g4j`, which exposed issue data, skill documentation, and deployment details through missing authentication and authorization checks on several API routes. The fixes were released in source tag **`v2026.416.0`**, and operators were advised to upgrade to that version or later. Public exploit code has increased risk, including a Rapid7 Metasploit module for `CVE-2026-41679`, while reporting cited proof-of-concept exploitation but no confirmed active exploitation in the wild at the time of publication.
Aug 6, 2026
A critical vulnerability tracked as **`CVE-2026-19264`** affects **Postiz**, the open-source social media scheduling platform, allowing unauthenticated attackers to read arbitrary files through the `/uploads` route by exploiting path traversal with URL-encoded separators. The flaw stems from unsafe joining of user-controlled path segments to the configured upload directory without proper normalization or confinement, enabling access to sensitive files available to the application process. The issue is rated **CVSS 9.8** and is classified as **CWE-22**. Exposure of environment files can reveal the **JWT signing secret**, database credentials, and third-party provider or billing secrets, creating a path to full instance compromise. Because Postiz uses signed session tokens with no expiry, attackers who obtain the JWT secret can forge persistent sessions for any account, including administrators, effectively taking over the instance. The vulnerability affects **`postiz-app` versions earlier than `2.22.1`**; a fix was introduced in commit **`7936062`**, which resolves file paths, verifies they remain inside the upload directory, and rejects out-of-scope requests.
Aug 7, 2026