Read the docs
TI-2026-36812 Aliases CVE-2026-49979

Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter

Priority LOW 23CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-209.

Summary

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed appsmith (appsmithorg): 1.99

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
appsmithorgappsmithbefore 1.991.99Patch availableCNA
  • appsmith Vendorappsmithorg Affected before 1.99 Fixed in 1.99 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*before 1.99Vulnerableappsmithorg
  • cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:* Versions before 1.99 Vulnerable ·appsmithorg

Remediation

  • Fix · CNA appsmith (appsmithorg) Fixed in 1.99

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49979

References

Exploit 1

  • TI-2026-40018 Appsmith: Caddy admin API exposed without authentication CVSS 3.1CRITICAL 9.9
  • TI-2026-18312 Account Takeover Vulnerability in Appsmith CVSS 3.1CRITICAL 9.7
  • TI-2026-36948 Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route CVSS 4.0HIGH 8.9
  • TI-2026-23691 Critical Stored XSS & Privilege Escalation in Appsmith CVSS 3.1CRITICAL 9.1
  • TI-2024-34357 AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json… CVSS 3.1HIGH 8.5
  • TI-2022-03744 Server-Side Request Forgery (SSRF) in appsmithorg/appsmith CVSS 3.1MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences