Skip to content

Broken Access Control Allows Viewer Role User to Query Datasources

Moderate
mohanarpit published GHSA-794x-gm8v-2wj6 Mar 25, 2025

Package

appsmith/appsmith-ee (DockerHub)

Affected versions

<=v1.50

Patched versions

>=v1.51

Description

Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys.

The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance.

Impact

Information Disclosure.

Patches

v1.51

Workarounds

None.

Severity

Moderate

CVE ID

CVE-2024-55965

Weaknesses

Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. Learn more on MITRE.