CVE-2024-55963

CVE-2024-55963 is an incorrect access control flaw (CWE-284) in Appsmith, the open-source low-code application platform, where the server restart API fails to verify super-user permissions on incoming requests. Any authenticated user without admin rights can call the restart API, causing the Appsmith server to restart. An attacker can repeatedly trigger restarts to sustain a denial of service, though the impact is confined to Appsmith's own server process within its container and does not affect confidentiality or integrity. All self-hosted and cloud deployments running a version prior to 1.51 are affected, particularly instances where low-privileged user accounts exist. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the high EPSS score (30.7%, 98th percentile) indicates an elevated likelihood of exploitation within 30 days.

What to do: Upgrade Appsmith to version 1.51 or later, which adds the missing super-user permission check on the restart API. As an interim mitigation, restrict the restart API endpoint so it is only reachable by admin users (e.g., via reverse-proxy access controls) and audit logs for repeated restart events. Note that exploitation requires valid low-privileged credentials, so review and minimize non-admin account access on exposed instances.