Appsmith CVE-2026-49979

Exploitation requires authenticated Appsmith admin-level access (PR:H per CVSS 4.0 vector) to call the POST /api/v1/admin/send-test-email endpoint with a JSON body supplying arbitrary smtpHost and smtpPort values. The Appsmith server must have network-layer reachability to the internal targets being probed - exploitation is highest-impact in cloud or enterprise environments where the Appsmith host can reach internal databases, orchestration APIs, or instance metadata services. The key enabling condition is that the existing IP_CHECK_FILTER bypass applies specifically because JavaMail uses raw TCP sockets rather than Spring WebClient HTTP connections; no non-default configuration is required. Exploitation is limited by the PR:H requirement (admin credentials must be obtained or already held) and by the read-only, confidentiality-only nature of the impact (no write or destructive capability).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) scores 5.1 (Medium), which accurately reflects the key limiting factor: exploitation requires high-privilege (admin-level) access to the Appsmith instance. This substantially constrains the realistic attack surface. No EPSS score is provided in the available data, and this CVE does not appear in the CISA KEV catalog, meaning active exploitation is not confirmed. No public POC is identified. The real-world risk is deployment-context dependent: Appsmith instances that sit on networks reachable to sensitive internal services - internal databases, Kubernetes API servers, cloud instance metadata endpoints (169.254.169.254), or other restricted services - face meaningful lateral enumeration risk from a compromised or rogue administrator. In cloud-native deployments with rich internal metadata services, the SC:L (subsequent system confidentiality) impact is likely understated. There is no integrity or availability impact confirmed by the description or CVSS data.

A malicious or compromised Appsmith administrator submits a POST request to /api/v1/admin/send-test-email with smtpHost set to an internal service address (e.g., 192.168.1.10 or 169.254.169.254) and smtpPort cycling through common service ports (22, 3306, 6443, 8080). JavaMail attempts a raw TCP connection, and the resulting MailException - which may include TCP-level error text or service banner fragments - is returned verbatim in the HTTP response, allowing systematic mapping of internal hosts and open services. No public POC has been identified, but the exploitation technique requires only standard HTTP client tooling and authenticated admin access.