Executive brief
ToolJet is an open-source platform for building internal tools and AI workflows. The ToolJet Database HTTP API fails to properly validate organization membership, allowing an authenticated user to access, modify, or delete tables in other organizations by manipulating API requests. An attacker could view sensitive data from other tenants' databases or disrupt their operations by modifying or dropping tables.
Technical details
The vulnerability is an authorization bypass in the ToolJet Database HTTP API (server/src/modules/tooljet-db/controller.ts). The JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, but permission checks in server/src/modules/tooljet-db/ability/index.ts grant VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES permissions without verifying the caller belongs to the organization specified in the :organizationId URL path parameter. An authenticated user can set tj-workspace-id to their own workspace and target another organization via GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and related table-management routes. This allows cross-tenant disclosure of table names, schemas, and row data, as well as creation, modification, or deletion of tables in other organizations. The fix is available in version 3.20.207-lts.
Affected products
- ToolJet ToolJet prior to 3.20.207-lts
Timeline
- 2026-08-11: disclosed
- 2026-08-04: patched: Fix merged in version 3.20.207-lts