fix(security): Datasource authorization bypass through import and fork hidden datasource reuse (GHSA-p37g-mfwx-3r9f)

[appsmith-smithes]

Description

fix(security): Datasource authorization bypass through import and fork hidden datasource reuse (GHSA-p37g-mfwx-3r9f)

CE PR. The EE validation PR listed below already ran the full EE
suite, Cypress included, and came back green. Merge this CE PR first; the
hourly CE→EE sync then carries the fix into EE.

Vulnerability

Field	Value
GHSA	GHSA-p37g-mfwx-3r9f
CVE	Not assigned
CVSS	8.1 (high)
CWE	CWE-863
Affected component	Datasource authorization bypass through import and fork hidden datasource reuse

Exposure Analysis

Fix

CE/EE sync

Merge this PR first. The hourly CE→EE sync propagates it to EE.

The linked EE validation PR is then refreshed from EE release and re-tested.

EE validation

EE validation PR: https://github.com/appsmithorg/appsmith-ee/pull/9393

EE CI status at the time this PR was opened: passing (ci-test|ci-test-limited, ci-test-result|ci-test-limited-result green).

Disclosure

Do not merge until advisory is ready for disclosure coordination.

After merge:

1. Confirm fix is in release branch
2. Coordinate with security team on disclosure timeline
3. Update advisory with patched version and publish
4. Notify reporter

Automation

/ok-to-test tags="@tag.All"

🔍 Cypress test results

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/30476127335
Commit: ca50f01
Cypress dashboard.
Tags: @tag.All
Spec:

---

Wed, 29 Jul 2026 18:44:22 UTC

Communication

Should the DevRel and Marketing teams inform users about this change?

• Yes
• No