CVE-2026-49979
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.
Risk Assessment
The risk involves potential internal network port scanning and service banner enumeration, which could expose sensitive infrastructure information and facilitate further attacks.
Recommendation
Immediately upgrade Appsmith to version 1.99 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Appsmith
See all- CVE-2026-22794Critical
Vulnerability in Appsmith before 1.93: the server uses the Origin header value as the email link baseUrl without validation. An attacker controlling Origin can cause password reset / email verification links to point to their domain, exposing authentication tokens and potentially leading to account takeover.
- CVE-2026-7299Medium
Appsmith's SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
- CVE-2026-5418High
In appsmithorg appsmith up to version 1.97, there is a server-side request forgery (SSRF) vulnerability in the computeDisallowedHosts function in WebClientUtils.java in the Dashboard component. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-34411Medium
A vulnerability in Appsmith versions prior to 1.98 exposes sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains.
Original NVD description (English source)
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS