Appsmith versions before 1.98 expose sensitive management API endpoints without requiring authentication. The flaw is a missing authentication check, identified as CWE‑306. Unauthenticated users can request URLs such as /api/v1/consolidated-api/view and /api/v1/tenants/current to collect configuration metadata, license data, and unsalted SHA‑256 hashes of administrative email domains, which can aid in reconnaissance and targeted attack planning.

All installations of Appsmith running any version older than 1.98 are affected, regardless of deployment size or environment. The vulnerability exists because the default API endpoints remain exposed and lack proper access controls.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network via simple HTTP requests to exposed endpoints, meaning that any entity able to reach the Appsmith host can exploit the flaw without additional prerequisites.