CVE-2026-49979
Last modified
CVE-2026-49979 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Appsmith | Appsmith | < 1.99 |
References
- https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86ghExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-49979?
How severe is CVE-2026-49979?
How do I fix CVE-2026-49979?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49971Laravel-Mediable before 7.0.0 contains a stored cross-site s…6.1
- CVE-2026-49972Laravel-Mediable before 7.0.0 contains a file upload vulnera…8.8
- CVE-2026-49973Hermes WebUI before version 0.51.358 contains an improper ac…9.4
- CVE-2026-49975Memory Allocation with Excessive Size Value vulnerability in…7.5
- CVE-2026-49977tarteaucitron.js is a compliant and accessible cookie banner…4.3
- CVE-2026-49978DOMPurify is a DOM-only cross-site scripting sanitizer for H…6.1
- CVE-2026-4998A weakness has been identified in Sinaptik AI PandasAI up to…7.3
- CVE-2026-49980Rclone is a command-line program to sync files and directori…9.8
- CVE-2026-49981Twig is a template language for PHP. Prior to 3.27.0, the pe…8.2
- CVE-2026-49982tmp is a temporary file and directory creator for node.js. I…8.2
- CVE-2026-49983Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…5.2
- CVE-2026-49984Kestra is an open-source, event-driven orchestration platfor…7.7
Are you affected by CVE-2026-49979?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST