CVE-2026-49979: Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IPCHECKFILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Appsmithto a version that resolves this vulnerability.Fixed in 1.99
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49979?
The severity of CVE-2026-49979 is classified as medium with a score of 5.1.
How do I fix CVE-2026-49979?
To fix CVE-2026-49979, update Appsmith to version 1.99 or later.
What are the potential impacts of CVE-2026-49979?
CVE-2026-49979 allows for Server Side Request Forgery (SSRF) by enabling attacker-controlled SMTP connections.
Which software is affected by CVE-2026-49979?
CVE-2026-49979 affects Appsmith versions prior to 1.99.
What kind of vulnerability is CVE-2026-49979?
CVE-2026-49979 is categorized as a Server Side Request Forgery (SSRF) vulnerability.