The flaw is a server‑side request forgery that allows an attacker to supply arbitrary SMTP host and port values to the administrative /api/v1/admin/send-test-email API endpoint. Because the endpoint opens a direct JavaMail TCP connection without validating the target IP, it bypasses any IP‑based request filtering that normally applies to outbound HTTP requests. The raw exception message returned by the JavaMail library is sent back in the API error response, providing the attacker with service banner information and enabling further internal port scanning or enumeration. This vulnerability is exemplified by the CWE‑918 and CWE‑209 classifications.

All Appsmith installations running any version older than 1.99 expose the vulnerable endpoint. The issue is addressed in releases 1.99 and newer, which remove the endpoint and add proper IP‑validation for outbound connections.

With a CVSS score of 5.1 the vulnerability is classified as moderate. No publicly available exploits are known, and the EPSS score is not reported, suggesting that exploitation is unlikely without privileged access. The flaw is listed in the CISA KEV catalog as not present, indicating limited industry exploitation. Attackers would need authenticated or privileged access to the administrative API to abuse the flaw, which reduces the risk in typical deployment scenarios.