# CVE-2026-73068: ToolJet Database cross-tenant authorization bypass

Source: https://junglewise.ai/threats/cve-2026-73068-tooljet-database-cross-tenant-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73068 · Severity: medium · CVSS 5.9 · Published 2026-08-11

ToolJet is an open-source platform for building internal tools and AI workflows. The ToolJet Database HTTP API fails to properly validate organization membership, allowing an authenticated user to access, modify, or delete tables in other organizations by manipulating API requests. An attacker could view sensitive data from other tenants' databases or disrupt their operations by modifying or dropping tables.

Technologies: [ToolJet](https://junglewise.ai/threats/technologies/tooljet). Vendors: [ToolJet](https://junglewise.ai/threats/vendors/tooljet).

## Quick answers

**Is CVE-2026-73068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73068 being exploited in the wild.

**How severe is CVE-2026-73068?** Medium severity, with a CVSS score of 5.9, published 11 August 2026.

**Which products and versions are affected?** ToolJet prior to 3.20.207-lts.

**Is there a fix for CVE-2026-73068?** A patch was published on 2026-08-04: Fix merged in version 3.20.207-lts Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73068 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73068?** Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the ToolJet Database HTTP API (server/src/modules/tooljet-db/controller.ts). The JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, but permission checks in server/src/modules/tooljet-db/ability/index.ts grant VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES permissions without verifying the caller belongs to the organization specified in the :organizationId URL path parameter. An authenticated user can set tj-workspace-id to their own workspace and target another organization via GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and related table-management routes. This allows cross-tenant disclosure of table names, schemas, and row data, as well as creation, modification, or deletion of tables in other organizations. The fix is available in version 3.20.207-lts.

## Affected products

- ToolJet ToolJet prior to 3.20.207-lts

## Timeline

- 2026-08-11: disclosed
- 2026-08-04: patched: Fix merged in version 3.20.207-lts

## References

- [https://github.com/ToolJet/ToolJet/commit/4c1dbef7487354bd4a2b5e1c633381ea783bf879](https://github.com/ToolJet/ToolJet/commit/4c1dbef7487354bd4a2b5e1c633381ea783bf879)
- [https://github.com/ToolJet/ToolJet/pull/17298](https://github.com/ToolJet/ToolJet/pull/17298)

## Related threats

- [ToolJet authorization bypass in app environments init endpoint](https://junglewise.ai/threats/cve-2026-70642-tooljet-before-3-21-94-fixed-in-commit-e5f387a-contains-an)
- [ToolJet missing authentication in onboarding signup endpoint](https://junglewise.ai/threats/cve-2026-126795-a-vulnerability-was-determined-in-tooljet-up-to-3-20-256-lts-3)
- [ToolJet authorization bypass in TooljetDB controller](https://junglewise.ai/threats/cve-2026-82875-tooljet-authorization-bypass-in-tooljetdb-controller)
- [ToolJet cross-tenant authorization bypass in tooljet-db endpoints](https://junglewise.ai/threats/cve-2026-82874-tooljet-cross-tenant-authorization-bypass-in-tooljet-db-endpoints)
- [ToolJet authorization bypass in resources export endpoint](https://junglewise.ai/threats/cve-2026-82873-tooljet-authorization-bypass-in-resources-export-endpoint)