GHSA-9wcp-79g5-5c3c Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators
SummaryThe `/api/v1/users/super` endpoint enforces a restriction that only one super user (Instance Administrator) can be created during initial setup. However, due to a Time-of-Check-Time-of-Use (TOCTOU) race condition in the `signupAndLoginSuper()` method, concurrent requests can bypass this restriction, allowing multiple unauthorized users to obtain Instance Administrator privileges.Severity**CWE**: CWE-367 (Time-of-Check Time-of-Use Race Condition)**CVSS 3.1**: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — **8.1 (HIGH)**Affected VersionAppsmith Community Edition v1.97.0-SNAPSHOT (release branch)Docker image: `appsmith/appsmith-ce:release` (pulled 2026-02-25)Commit: `55ac824f8d42f934cc7a69f8abc52880a6ad39ef`Root CauseThe `signupAndLoginSuper()` method in `UserSignupCEImpl.java` (lines 270–295) performs a non-atomic check-then-act sequence:The `isUsersEmpty()` method (`CustomUserRepositoryCEImpl.java`, lines 35–44) queries MongoDB without any locking mechanism:There is no `@Transactional` annotation, no distributed lock, and no MongoDB transaction wrapping the check-and-create sequence. In the reactive WebFlux environment, concurrent requests are processed in parallel, widening the race window significantly.Proof of ConceptEnvironment SetupStep 1: Verify Fresh StateStep 2: Send Concurrent RequestsStep 3: Verify in MongoDBObserved Results| Metric | Expected | Actual |
|--------|----------|--------|
| Users created | 1 | **10** |
| Users with `manage:users` policy | 1 | **10** |
| Users in Instance Administrator Role | 1 | **2** |All 10 concurrent requests returned HTTP 302 (success redirect), bypassing the single-user restriction.Impact**Authorization Bypass**: The one-admin-only restriction is completely defeated by concurrent requests.**Persistent Backdoor**: The attacker's admin account persists alongside the legitimate administrator. The legitimate admin has no indication that another admin exists unless they manually inspect the user list.**Full Instance Compromise**: Instance Administrator privileges grant:User management (create, delete, modify all users)Access to all datasource credentials (database passwords, API keys)Modification of all applications and their server-side logicEnvironment configuration (SMTP, OAuth, encryption settings)Attack ScenarioAttacker monitors for newly deployed Appsmith instances (e.g., via Shodan, Censys, or internal network scanning).Attacker polls `GET /api/v1/users/me` — if the response contains `"email": "anonymousUser"`, the instance has not been set up yet.Attacker sends multiple concurrent `POST /api/v1/users/super` requests.Legitimate administrator completes setup normally, unaware that an attacker account also received Instance Administrator privileges.Attacker now has persistent, full administrative access to the instance.Suggested FixOption A: MongoDB Transaction (Recommended)Wrap the check-and-create in a MongoDB transaction to ensure atomicity:Option B: Distributed LockUse Redis (already available in Appsmith's stack) to acquire an exclusive lock:Option C: Unique ConstraintAdd a MongoDB unique partial index that prevents more than one super admin:CSRF NoteThe `POST /api/v1/users/super` endpoint accepts `application/x-www-form-urlencoded` content type. CSRF protection can be bypassed by including the `X-Requested-By: Appsmith` header (`CsrfConfigCE.java`, lines 99–102), which is a static, publicly known value.
CVSS v3.1 score: 8.1