Appsmith versions 1.94 and older allow any user with internet access to trigger edit‑mode, unpublished actions by making a POST request to /api/v1/actions/execute with viewMode=false (or omitting the flag). This bypasses the supposed boundary that public viewers should only run published actions, enabling the attacker to read sensitive data, run edit‑mode queries or APIs, and trigger side‑effect behaviors. The vulnerability is a classic example of missing access control for authorized actions.

The affected vendor is Appsmith, specifically the appsmith org product. All releases at or below version 1.94 are impacted. No higher versions were listed in the advisory; newer releases have presumably removed the flaw.

The CVSS base score of 9.4 indicates critical severity, while the EPSS score is below 1%—the exploit probability is low but non‑zero. The vulnerability is not listed in the CISA KEV catalog, but since it is reachable by unauthenticated users on any public Appsmith app, the practical risk is high. Attackers need only identify a public app and send a crafted request; no special credentials or prior knowledge are required. The lack of an available patch at the time of the advisory further compounds the risk, making mitigation actions essential.