CVE-2026-49979 Details
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
A vulnerability in Appsmith Server in versions prior to 1.99 allows for server-side request forgery (SSRF) through the POST /api/v1/admin/send-test-email endpoint. The endpoint accepts user-supplied smtpHost and smtpPort values, which are used to establish a raw JavaMail TCP connection without any IP validation. This bypasses the WebClient IP check filter, enabling access to internal services and metadata endpoints on cloud platforms. Additionally, the endpoint leaks raw error messages from MailException, which can be exploited for internal port scanning and service enumeration.
Users should update to Appsmith Server version 1.99 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appsmith appsmith | < 1.99 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |