CVE-2026-49979: Appsmith Email Testing SSRF and Information Disclosure

Technical summary

The POST /api/v1/admin/send-test-email endpoint in Appsmith < 1.99 instantiates JavaMail connections using attacker-supplied smtpHost and smtpPort parameters without IP filtering. Unlike the application's HTTP request layer (which enforces IP_CHECK_FILTER to block RFC 1918 ranges), raw Java SMTP connections bypass this control entirely. Furthermore, the endpoint returns unfiltered MailException error messages in API responses, enabling banner grabbing and port-state inference via timing and exception text. The vulnerability chains CWE-209 (information exposure through error messages) with CWE-918 (server-side request forgery via mail protocols).

Business impact

An admin user compromised or malicious can map internal network topology, identify running services, and gather version information about internal mail systems or other services listening on TCP ports. This reconnaissance capability significantly raises the risk of follow-on attacks targeting internal infrastructure. For organizations relying on Appsmith for internal tool consolidation, this expands the attack surface without triggering typical network intrusion detection. The low CVSS score reflects the requirement for admin privileges, but the information disclosure can be highly valuable to attackers already inside the admin tier.

Affected systems

Appsmith versions prior to 1.99 are affected. The vulnerability is fixed in version 1.99 and later. Organizations running self-hosted or cloud-deployed Appsmith instances should verify their running version against the 1.99 release line.

Exploitability

Exploitation requires valid admin credentials—the endpoint is access-restricted and cannot be called anonymously. An attacker must already have gained admin privileges through credential compromise, insider threat, or prior vulnerability. Given this prerequisite, exploitation is trivial: simple HTTP requests to the test-email endpoint with crafted SMTP parameters yield immediate reconnaissance results. The detailed error responses make each probe actionable without trial-and-error.

Remediation

Upgrade Appsmith to version 1.99 or later. The patch applies IP filtering to SMTP host resolution, preventing connections to private network ranges. For organizations unable to upgrade immediately, implement network-level controls: restrict outbound SMTP connections from the Appsmith host to trusted mail servers only, and disable or monitor the test-email feature via access controls if possible.

Patch guidance

Apply Appsmith version 1.99 or later. Consult the official Appsmith release notes and upgrade documentation for your deployment model (self-hosted Docker, cloud, or Kubernetes). Test the email configuration feature in a non-production environment after patching to confirm no disruption to legitimate admin workflows. If you operate a Appsmith SaaS instance, verify that your provider has deployed the patch; most SaaS providers auto-update, but confirmation is prudent.

Detection guidance

Monitor for repeated POST requests to /api/v1/admin/send-test-email with varying smtpHost and smtpPort parameters, particularly those targeting non-standard ports or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Correlate with admin user session logs to identify the originating user. Examine Appsmith API logs for MailException errors containing banner or service-identification strings (e.g., 'Connection refused,' 'service not available,' version headers). A sudden spike in test-email API calls from a single admin session may indicate reconnaissance activity.

Why prioritize this

Although the CVSS score is low (2.7), this vulnerability is worth prompt attention in environments where Appsmith hosts sensitive internal tools or sits on networks containing critical infrastructure. The reconnaissance capability enables targeted follow-on attacks, and the fix is straightforward (version bump). Prioritize based on your admin-tier security posture: if admin accounts are tightly controlled and monitored, risk is contained; if admin credentials are widely distributed or frequently rotated, elevate the priority. The vulnerability is not listed in CISA KEV, reflecting its low immediate exploitation risk in the wild.

Risk score, explained

The CVSS 3.1 score of 2.7 (LOW) reflects the requirement for admin authentication (PR:H), local impact only (S:U), and information disclosure without confidentiality loss to other users (C:L). However, this score underweights the reconnaissance value in a multi-layered attack. Internally, SEC.co recommends evaluating organizational context: if your Appsmith deployment is air-gapped or serves non-sensitive tools, risk is minimal; if it's a hub for internal SaaS management or sits behind a compromised VPN, risk rises materially. The 'low' designation should not trigger complacency about patching.

Frequently asked questions