CVE-2026-49979

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.99

Description The 'POST /api/v1/admin/send-test-email' endpoint allows the use of attacker-controlled smtpHost and smtpPort values to establish a raw JavaMail TCP connection. This process bypasses the WebClientUtils.IP CHECK FILTER, as that filter only applies to Spring WebClient HTTP requests. Furthermore, the API error response returns the raw MailException.getMessage() verbatim, which allows for error-based internal port scanning and service banner enumeration.

Recommendations Update to version 1.99. Restrict access to the 'POST /api/v1/admin/send-test-email' endpoint to minimize the risk of exploitation.