GHSA-j9gf-vw2f-9hrw

### Summary A configuration-dependent origin validation bypass was identified in Appsmith’s password reset and email verification flows on current `release`. Both flows derive the email-link base URL from the request `Origin` header. The current validation only enforces a trusted base URL when `APPSMITH_BASE_URL` is configured. If that setting is unset, the application accepts the caller-supplied origin and uses it to generate token-bearing reset and verification links. On deployments with email delivery enabled and `APPSMITH_BASE_URL` unset, this can cause Appsmith to send security-sensitive links whose clickable host is attacker-controlled, which can plausibly lead to account takeover after victim interaction. ### Details The current `release` head at commit `e77639eca4974469c1e676904851ffdaedd38111` was reviewed. The relevant routes are publicly reachable in `SecurityConfig.java`: - `POST /forgotPassword` is permitted without authentication at line `209` - `POST /resendEmailVerification` is permitted without authentication at line `228` In `UserControllerCE.java`, both flows copy the request `Origin` header into the DTO field used as the email-link base URL: - `forgotPasswordRequest(...)` at lines `91-94` - `resendEmailVerification(...)` at lines `189-193` In `UserServiceCEImpl.java`, base URL validation is conditional: - `@Value("${APPSMITH_BASE_URL:}")` at line `113` - `resolveSecureBaseUrl(...)` at lines `132-145` That method explicitly documents and implements this behavior: - if `APPSMITH_BASE_URL` is configured, the provided URL must match it - if `APPSMITH_BASE_URL` is unset, the provided URL is accepted for backward compatibility The resulting base URL is then used to construct token-bearing links: - `FORGOT_PASSWORD_CLIENT_URL_FORMAT` at line `149` - reset URL generation at lines `282-289` - `EMAIL_VERIFICATION_CLIENT_URL_FORMAT` at line `152` - verification URL generation at lines `931-940` This means the base URL is not only used for bran