fix(security): return uniform responses on pre-auth email endpoints and remove unused routes (#41996)

## What
Makes two unauthenticated email endpoints return a consistent response
regardless of
whether an account exists, and removes two unused public routes.

## Why
`POST /users/forgotPassword` and `POST /users/resendEmailVerification`
returned
different responses for a known vs unknown email (and, for resend, also
revealed
verified state). This let an unauthenticated caller determine which
email addresses
have accounts.

## Changes
- **forgotPassword** — unknown email and over-limit both return the same
generic
success (HTTP 200), sending no email. The per-account reset limit is
unchanged.
- **resendEmailVerification** — unknown, already-verified, and
verification-disabled
cases all return the same generic success, sending no email. Adds a
per-email send
limit: over the limit it still returns the generic success (so it can't
be used to
probe), and it fails open if the limiter is unavailable so legitimate
verification
  emails are never blocked.
- Removes two `permitAll` routes (`GET /users/invite/verify`, `PUT
/users/invite/confirm`)
  that have no server handler.

## Testing
- Controller + service tests assert identical status and body across
known-under-limit / known-over-limit / known-verified / unknown /
verification-disabled
for both endpoints, plus the silent per-email limit and its fail-open
path.
- Relevant server module tests pass.


Fixes
https://linear.app/appsmith/issue/APP-15349/security-medium-user-enumeration-via-forgot-password

<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/29493040653>
> Commit: 6017e79
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29493040653&attempt=2"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.All`
> Spec:
> <hr>Thu, 16 Jul 2026 19:50:33 UTC
<!-- end of auto-generated comment: Cypress test results  -->



## Automation
/ok-to-test tags="@tag.All"

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wyattwalter

app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/SecurityConfig.java

@@ -218,8 +218,6 @@ public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
                                 ServerWebExchangeMatchers.pathMatchers(
                                         HttpMethod.GET, USER_URL + "/verifyPasswordResetToken"),
                                 ServerWebExchangeMatchers.pathMatchers(HttpMethod.PUT, USER_URL + "/resetPassword"),
-                                ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, USER_URL + "/invite/verify"),
-                                ServerWebExchangeMatchers.pathMatchers(HttpMethod.PUT, USER_URL + "/invite/confirm"),
                                 ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, USER_URL + "/me"),
                                 ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, ASSET_URL + "/*"),
                                 ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, ACTION_URL + "/**"),

app/server/appsmith-server/src/main/java/com/appsmith/server/constants/RateLimitConstants.java

@@ -5,4 +5,7 @@ public class RateLimitConstants {
             "Your account is suspended for 24 hours. Please reset your password to continue";
     public static final String BUCKET_KEY_FOR_LOGIN_API = "login";
     public static final String BUCKET_KEY_FOR_TEST_DATASOURCE_API = "test_datasource_or_execute_query";
+
+    // Per-email throttle for the unauthenticated resend-email-verification endpoint (anti-abuse).
+    public static final String BUCKET_KEY_FOR_RESEND_EMAIL_VERIFICATION_API = "resend_email_verification";
 }

app/server/appsmith-server/src/main/java/com/appsmith/server/ratelimiting/RateLimitConfig.java

@@ -38,6 +38,10 @@ public RateLimitConfig(AbstractRedisClient redisClient) {
         apiConfigurationMap.put(
                 RateLimitConstants.BUCKET_KEY_FOR_TEST_DATASOURCE_API,
                 createBucketConfiguration(Duration.ofSeconds(5), 3));
+        // Per-email cap for resend-email-verification: at most 5 requests per email per rolling 24h window.
+        apiConfigurationMap.put(
+                RateLimitConstants.BUCKET_KEY_FOR_RESEND_EMAIL_VERIFICATION_API,
+                createBucketConfiguration(Duration.ofDays(1), 5));
         // Add more API configurations as needed
     }
 

app/server/appsmith-server/src/main/java/com/appsmith/server/services/ce/UserServiceCEImpl.java

@@ -225,8 +225,12 @@ private Mono<Boolean> processForgotPasswordTokenGeneration(
                             .findByEmailAndOrganizationId(email, organizationId)
                             .switchIfEmpty(repository.findFirstByEmailIgnoreCaseAndOrganizationIdOrderByCreatedAtDesc(
                                     email, organizationId))
-                            .switchIfEmpty(Mono.error(
-                                    new AppsmithException(AppsmithError.NO_RESOURCE_FOUND, FieldName.USER, email)))
+                            // Anti-enumeration (CWE-204, GHSA-fvrq-g89c-fgg6): do not surface a distinct
+                            // NO_RESOURCE_FOUND (HTTP 404) for an unknown email. When no user matches, this inner
+                            // Mono simply stays empty; the token save and email dispatch below are skipped and
+                            // thenReturn(true) still emits the same generic success (HTTP 200, {"data": true}) that
+                            // the valid path returns. This makes the response for an unknown email indistinguishable
+                            // from a known one, so an unauthenticated caller cannot enumerate registered accounts.
                             .flatMap(user -> {
                                 // an user found with the provided email address
                                 // Generate the password reset link for the user
@@ -240,11 +244,22 @@ private Mono<Boolean> processForgotPasswordTokenGeneration(
                                             passwordResetToken.setFirstRequestTime(Instant.now());
                                             return Mono.just(passwordResetToken);
                                         }))
-                                        .map(resetToken -> {
-                                            // check the validity of the token
-                                            validateResetLimit(resetToken);
+                                        .flatMap(resetToken -> {
+                                            // Track this request and check the per-account reset limit.
+                                            // Anti-enumeration (CWE-204, GHSA-fvrq-g89c-fgg6): when a known
+                                            // account is over its limit we must NOT surface a distinct 429 —
+                                            // that would tell an unauthenticated caller the account exists.
+                                            // Instead we complete the chain empty (skipping the token save and
+                                            // email dispatch below) so thenReturn(true) emits the same generic
+                                            // success returned for the unknown-user and under-limit cases.
+                                            // Anti-spam: over the limit we deliberately do not issue a fresh
+                                            // reset link or send another email; the request count is still
+                                            // tracked so the limit keeps functioning.
+                                            if (!isWithinResetLimit(resetToken)) {
+                                                return Mono.empty();
+                                            }
                                             resetToken.setTokenHash(passwordEncoder.encode(token));
-                                            return resetToken;
+                                            return Mono.just(resetToken);
                                         });
                             });
                 })
@@ -269,28 +284,40 @@ private Mono<Boolean> processForgotPasswordTokenGeneration(
     }
 
     /**
-     * This method checks whether the reset request limit has been exceeded.
-     * If the limit has been exceeded, it raises an Exception.
-     * Otherwise, it'll update the counter and date in the resetToken object
+     * Tracks a password-reset request against the per-account limit (max 3 per rolling 24h window)
+     * and reports whether the caller is still within that limit.
+     * <p>
+     * When under the limit the counter is incremented (and the window start stamped on the first
+     * request); when the 24h window has elapsed the counter is reset and the request is allowed.
+     * When the limit is exceeded within the window this returns {@code false} without mutating the
+     * counter, so the limit keeps functioning across subsequent requests.
+     * <p>
+     * This intentionally no longer throws {@link AppsmithError#TOO_MANY_REQUESTS}: on the
+     * unauthenticated forgot-password endpoint a distinct 429 would reveal that the account exists
+     * (CWE-204). Callers treat {@code false} as "complete with the generic success response and send
+     * no email" rather than surfacing a distinguishable error.
      *
      * @param resetToken {@link PasswordResetToken}
+     * @return {@code true} if the request is within the limit and a reset email may be sent;
+     *     {@code false} if the account is over its limit and no email should be sent
      */
-    private void validateResetLimit(PasswordResetToken resetToken) {
+    private boolean isWithinResetLimit(PasswordResetToken resetToken) {
         if (resetToken.getRequestCount() >= 3) {
             Duration duration = Duration.between(resetToken.getFirstRequestTime(), Instant.now());
             long l = duration.toHours();
-            if (l >= 24) { // ok, reset the counter
+            if (l >= 24) { // window elapsed: reset the counter and allow the request
                 resetToken.setRequestCount(1);
                 resetToken.setFirstRequestTime(Instant.now());
-            } else { // too many requests, raise an exception
-                throw new AppsmithException(AppsmithError.TOO_MANY_REQUESTS);
-            }
-        } else {
-            resetToken.setRequestCount(resetToken.getRequestCount() + 1);
-            if (resetToken.getFirstRequestTime() == null) {
-                resetToken.setFirstRequestTime(Instant.now());
+                return true;
             }
+            // too many requests within the window: over the limit
+            return false;
+        }
+        resetToken.setRequestCount(resetToken.getRequestCount() + 1);
+        if (resetToken.getFirstRequestTime() == null) {
+            resetToken.setFirstRequestTime(Instant.now());
         }
+        return true;
     }
 
     private Boolean isEmailVerificationTokenValid(EmailVerificationToken emailVerificationToken) {
@@ -878,16 +905,21 @@ private Mono<Boolean> processResendEmailVerification(
                                 email, organizationId)))
                 .cache();
 
-        return userMono.switchIfEmpty(
-                        Mono.error(new AppsmithException(AppsmithError.NO_RESOURCE_FOUND, FieldName.USER, email)))
-                .flatMap(user -> {
+        // Verification-email dispatch chain. Anti-enumeration (CWE-204): the unknown-email,
+        // already-verified and verification-not-enabled branches all complete empty instead of throwing a
+        // distinct error (previously 404 / 400), so the thenReturn(true) at the end emits the same generic
+        // success (HTTP 200, {"data": true}) for every case and no email is dispatched. An unauthenticated
+        // caller therefore cannot tell whether the address is registered, already verified, or whether
+        // verification is enabled at the instance level.
+        Mono<Boolean> dispatchMono = userMono.flatMap(user -> {
                     if (TRUE.equals(user.getEmailVerified())) {
-                        return Mono.error(new AppsmithException(AppsmithError.USER_ALREADY_VERIFIED));
+                        // Already verified: send no email, but keep the response indistinguishable.
+                        return Mono.<EmailVerificationToken>empty();
                     }
                     return instanceVariablesHelper.isEmailVerificationEnabled().flatMap(emailVerificationEnabled -> {
-                        // Email verification not enabled at instance level
+                        // Email verification not enabled at instance level: send no email, response unchanged.
                         if (!TRUE.equals(emailVerificationEnabled)) {
-                            return Mono.error(new AppsmithException(AppsmithError.EMAIL_VERIFICATION_NOT_ENABLED));
+                            return Mono.<EmailVerificationToken>empty();
                         }
                         return emailVerificationTokenRepository
                                 .findByEmail(user.getEmail())
@@ -936,6 +968,22 @@ private Mono<Boolean> processResendEmailVerification(
                             user, verificationUrl, resendEmailVerificationDTO.getBaseUrl());
                 })
                 .thenReturn(true);
+
+        // Per-email rate limit (anti-abuse). Applied uniformly on the submitted address so behaviour does
+        // not vary by account existence. Over the limit we skip dispatch and still return the same generic
+        // success — surfacing a distinct 429 here would re-introduce an enumeration oracle on this
+        // unauthenticated endpoint.
+        return rateLimitService
+                .tryIncreaseCounter(
+                        RateLimitConstants.BUCKET_KEY_FOR_RESEND_EMAIL_VERIFICATION_API, email.toLowerCase())
+                .flatMap(withinLimit -> TRUE.equals(withinLimit) ? dispatchMono : Mono.just(true))
+                // Fail open: if the limiter itself errors (e.g. Redis is unreachable), do not block a
+                // legitimate verification email. This runs the same dispatch path regardless of account
+                // state, so it does not reintroduce an enumeration oracle.
+                .onErrorResume(error -> {
+                    log.error("Resend email verification rate limiter errored; failing open.", error);
+                    return dispatchMono;
+                });
     }
 
     private String getEmailVerificationErrorRedirectUrl(AppsmithError appsmithError, String userEmail, Object... args) {

app/server/appsmith-server/src/test/java/com/appsmith/server/controllers/UserControllerForgotPasswordTest.java

@@ -0,0 +1,106 @@
+package com.appsmith.server.controllers;
+
+import com.appsmith.server.configurations.RedisTestContainerConfig;
+import com.appsmith.server.configurations.SecurityTestConfig;
+import com.appsmith.server.helpers.RedisUtils;
+import com.appsmith.server.services.UserService;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.context.annotation.Import;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.test.web.reactive.server.EntityExchangeResult;
+import org.springframework.test.web.reactive.server.WebTestClient;
+import org.springframework.web.reactive.function.BodyInserters;
+import reactor.core.publisher.Mono;
+
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
+
+/**
+ * Controller-level anti-enumeration guard (CWE-204, GHSA-fvrq-g89c-fgg6) for the unauthenticated
+ * {@code POST /api/v1/users/forgotPassword} endpoint.
+ *
+ * <p>The property under test is indistinguishability: the HTTP response (status line AND body) must be
+ * identical whether the email is a known account under its reset limit, a known account over its limit, or
+ * an unknown address. The full end-to-end rate-limit behaviour (counter accumulation, over-limit, window
+ * reset) is covered at the service layer by {@code UserServiceTest}; here the service is mocked so the
+ * controller's own response contract is what is pinned. Post-fix the service yields the same generic
+ * success ({@code true}) for all three cases, so all three must produce byte-identical HTTP responses. A
+ * regression that let any case surface a distinct error (e.g. a 404 or 429 from a thrown exception) would
+ * change that case's status and body and fail this test.
+ *
+ * <p>Note on the body: this endpoint is annotated {@code @JsonView(Views.Public.class)} and returns a bare
+ * {@code Boolean}; under the application's view-based serialization the success body is empty (the client
+ * only depends on the 200 status). This test therefore asserts the full response is identical across cases
+ * rather than pinning a particular JSON envelope — identical status + body is the anti-enumeration bar.
+ */
+@SpringBootTest
+@AutoConfigureWebTestClient
+@Import({SecurityTestConfig.class, RedisUtils.class, RedisTestContainerConfig.class})
+public class UserControllerForgotPasswordTest {
+
+    @MockBean
+    UserService userService;
+
+    @Autowired
+    private WebTestClient webTestClient;
+
+    private EntityExchangeResult<byte[]> forgotPassword(String email) {
+        return webTestClient
+                .post()
+                .uri("/api/v1/users/forgotPassword")
+                .header(HttpHeaders.ORIGIN, "https://my-instance.example.com")
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(BodyInserters.fromValue("{\"email\":\"" + email + "\"}"))
+                .exchange()
+                .expectBody()
+                .returnResult();
+    }
+
+    @Test
+    public void forgotPassword_returnsIdenticalResponse_forKnownUnderLimit_knownOverLimit_andUnknown() {
+        // Post-fix the service yields the same generic success for every one of these cases; an over-limit
+        // or unknown email no longer surfaces a distinct error (404 / 429) to the controller.
+        Mockito.when(userService.forgotPasswordTokenGenerate(any())).thenReturn(Mono.just(true));
+
+        EntityExchangeResult<byte[]> knownUnderLimit = forgotPassword("api_user");
+        EntityExchangeResult<byte[]> knownOverLimit = forgotPassword("api_user");
+        EntityExchangeResult<byte[]> unknown = forgotPassword("nobody-does-not-exist@example.com");
+
+        // All three succeed with HTTP 200 ...
+        assertEquals(HttpStatus.OK, knownUnderLimit.getStatus());
+        assertEquals(HttpStatus.OK, knownOverLimit.getStatus());
+        assertEquals(HttpStatus.OK, unknown.getStatus());
+
+        // ... and their bodies are byte-identical, so the caller cannot tell the cases apart.
+        byte[] under = normalize(knownUnderLimit.getResponseBody());
+        assertArrayEquals(under, normalize(knownOverLimit.getResponseBody()));
+        assertArrayEquals(under, normalize(unknown.getResponseBody()));
+    }
+
+    @Test
+    public void forgotPassword_emptyServiceCompletion_returnsSameSuccessResponse() {
+        // Base-URL-unresolved path (Root Cause 1): the service completes empty; the controller's
+        // defaultIfEmpty(true) must still produce the same HTTP 200 success as the value-emitting path.
+        Mockito.when(userService.forgotPasswordTokenGenerate(any())).thenReturn(Mono.just(true));
+        EntityExchangeResult<byte[]> emitted = forgotPassword("api_user");
+
+        Mockito.when(userService.forgotPasswordTokenGenerate(any())).thenReturn(Mono.empty());
+        EntityExchangeResult<byte[]> empty = forgotPassword("api_user");
+
+        assertEquals(HttpStatus.OK, emitted.getStatus());
+        assertEquals(HttpStatus.OK, empty.getStatus());
+        assertArrayEquals(normalize(emitted.getResponseBody()), normalize(empty.getResponseBody()));
+    }
+
+    private static byte[] normalize(byte[] body) {
+        return body == null ? new byte[0] : body;
+    }
+}