What’s Vulnerable › Vulnerabilities
CVE-2026-49979: Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-06-24 · updated 2026-10-25
- Weakness: CWE-209
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
Affected products
- appsmithorg appsmith: before 1.99 — fixed in 1.99
How to fix
Upgrade to a fixed version: appsmithorg appsmith 1.99. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-49979 or the next vulnerability affects your stack