Summary

A Broken Object-Level Authorization (BOLA/IDOR) vulnerability exists in the Appsmith OSS endpoint:

PUT /api/v1/pages/{pageId}/dependencyMap

An authenticated attacker can modify another workspace’s page dependencyMap by supplying a valid page ID when the branchName header is omitted.

The vulnerable execution path performs a direct repository update without enforcing the expected MANAGE_PAGES authorization check.

Details

Affected endpoint:

PUT /api/v1/pages/{pageId}/dependencyMap

Affected execution flow:

PageControllerCE.updateDependencyMap()
→ NewPageServiceCEImpl.updateDependencyMap()
→ CustomNewPageRepositoryCEImpl.updateDependencyMap()

In the non-branch execution path, the service directly performs:

repository.updateDependencyMap(pageId, dependencyMap)

without resolving the target page through a permission-checked lookup using AclPermission.MANAGE_PAGES.

The branch-aware execution path correctly enforces authorization, while the default path does not.

As a result, any authenticated user who knows a valid page ID can modify another workspace’s unpublished page dependency map.

PoC

Environment:

• Local Appsmith OSS instance
• Two authenticated users
• Separate workspaces

User A:

1. Create Workspace A
2. Create an application and page
3. Obtain the target pageId

Example:

curl -i -u 'userA@example.com:PASSWORD' \
'http://localhost/api/v1/pages?applicationId=APP_ID&mode=EDIT'

User B:
User B must not have access to Workspace A.

Send:

curl -i -u 'userB@example.com:PASSWORD' \
-X PUT 'http://localhost/api/v1/pages/PAGE_ID/dependencyMap' \
-H 'Content-Type: application/json' \
--data '{"securityTestNode":["Text1.text"]}'

Observed behavior:

• Request succeeds with HTTP 200
• Victim page dependencyMap is modified
• Unauthorized cross-workspace modification occurs

Control test:

When supplying a valid branchName header:

-H 'branchName: master'

the authorization-protected path executes correctly and the unauthorized request fails.

Impact

An authenticated attacker can:

• modify another workspace’s unpublished page state
• tamper with internal dependency structures
• potentially destabilize editor evaluation behavior
• cause integrity violations across workspaces

This issue has not been publicly disclosed and is being shared privately in accordance with Appsmith’s security policy.