Appsmith CVE-2026-49979

Q: What is the CVSS score of CVE-2026-49979?

CVE-2026-49979 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

Error Message Information Leak (CWE-209)

2026-06-24 GitHub_M

Java Information Disclosure Appsmith Appsmithorg

5.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.1 MEDIUM

Network-reachable admin endpoint; PR:H because admin credentials required; S:C because probing extends to systems beyond Appsmith itself; C:L for internal topology/banner leakage only.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 22:36 vuln.today

DescriptionCVE.org

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without any IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration. This vulnerability is fixed in 1.99.

AnalysisAI

Server-side request forgery and internal network enumeration in Appsmith (prior to 1.99) is enabled by the POST /api/v1/admin/send-test-email endpoint accepting attacker-controlled smtpHost and smtpPort values, which JavaMail uses to establish raw TCP connections without IP address validation - completely bypassing the application's existing WebClientUtils.IP_CHECK_FILTER. Verbatim MailException error messages are returned in API responses, enabling authenticated administrators (or attackers who have compromised admin credentials) to probe internal network topology, enumerate open ports, and harvest service banners. No public exploit identified at time of analysis; the vulnerability is fixed in version 1.99.

Technical ContextAI

Appsmith is a low-code platform for building internal tools, admin panels, and dashboards, typically deployed in enterprise environments with privileged network access to internal infrastructure. The vulnerable endpoint POST /api/v1/admin/send-test-email uses the JavaMail API (javax.mail) to construct raw TCP socket connections to caller-supplied smtpHost and smtpPort values. Critically, the application's IP allowlist/blocklist enforcement (WebClientUtils.IP_CHECK_FILTER) is implemented only for Spring WebClient HTTP-layer requests and is architecturally blind to JavaMail's lower-level socket connections - creating a filter bypass. CWE-209 (Generation of Error Message Containing Sensitive Information) captures the root cause: the raw MailException.getMessage() string, which may contain connection-level details or service banners from the probed host, is reflected verbatim in the API response body. Affected product CPE: cpe:2.3:a:appsmithorg:appsmith:*:*:*:*:*:*:*:* for all versions prior to 1.99.

RemediationAI

Upgrade Appsmith to version 1.99 or later, which is the vendor-confirmed fix per GitHub Security Advisory GHSA-vvxf-f8q9-86gh (https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh). For organizations unable to upgrade immediately, restrict access to the /api/v1/admin/send-test-email endpoint at the network perimeter, reverse proxy, or WAF layer - note this disables SMTP test functionality as a trade-off. Deploy egress network filtering on the Appsmith server host to block outbound connections to RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local ranges (169.254.0.0/16 including cloud metadata), and any other sensitive internal CIDR ranges; this limits the reach of probes even if the endpoint remains callable. Tightly scope and audit Appsmith admin credentials and monitor for unusual calls to the SMTP test endpoint as a detection measure.