CVE-2026-49979CWE-209CWE-918

Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter

Medium · published June 24, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00369 · 29.6th percentile
Weaknesses
CWE-209 · Generation of Error Message Containing Sensitive Information; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-24T21:38Z
EPSS history
Timeline
  • 24 JUN 21:38Z
    Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
    cvelistv5