{"items":[{"id":"NVI-00018387","kind":"vulnerability","title":"Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-9wcp-79g5-5c3c"],"plain_summary":"GitHub lists this reviewed advisory for com.appsmith:server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1aba35501458092dc4124dbfaa2ab29f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-12T18:27:57.000Z","value":"8.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1aba35501458092dc4124dbfaa2ab29f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1aba35501458092dc4124dbfaa2ab29f","url":"https://github.com/advisories/GHSA-9wcp-79g5-5c3c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-9wcp-79g5-5c3c","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T15:13:13.153Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1aba35501458092dc4124dbfaa2ab29f"],"technology":"com.appsmith:server","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `/api/v1/users/super` endpoint enforces a restriction that only one super user (Instance Administrator) can be created during initial setup. However, due to a Time-of-Check-Time-of-Use (TOCTOU) race condition in the `signupAndLoginSuper()` method, concurrent requests can bypass this restriction, allowing multiple unauthorized users to obtain Instance Administrator privileges.\n\n## Severity\n\n- **CWE**: CWE-367 (Time-of-Check Time-of-Use Race Condition)\n- **CVSS 3.1**: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — **8.1 (HIGH)**\n\n## Affected Version\n\n- Appsmith Community Edition v1.97.0-SNAPSHOT (release branch)\n- Docker image: `appsmith/appsmith-ce:release` (pulled 2026-02-25)\n- Commit: `55ac824f8d42f934cc7a69f8abc52880a6ad39ef`\n\n## Root Cause\n\nThe `signupAndLoginSuper()` method in `UserSignupCEImpl.java` (lines 270–295) performs a non-atomic check-then-act sequence:\n\n```java\n// Step 1: CHECK — query MongoDB for existing users\nuserService.isUsersEmpty()\n    .flatMap(isEmpty -> {\n        if (!Boolean.TRUE.equals(isEmpty)) {\n            return Mono.error(new AppsmithException(AppsmithError.UNAUTHORIZED_ACCESS));\n        }\n        // Step 2: ACT — create user and grant admin (no","public_affected_ranges":["< 1.99.0"]}],"null_published_at":"2026-11-07T07:07:39.830Z","source_updated_at":"2026-06-12T18:27:57.000Z","source_disclosed_at":"2026-06-12T18:27:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T15:13:13.153Z"}],"next_cursor":null,"snapshot_revision":"42594"}