Executive brief
ToolJet Database is a low-code platform component that allows users to query and manipulate data from connected sources. A privilege escalation flaw in the join_tables endpoint allows any authenticated user—including those with minimal permissions—to read database tables from workspaces they don't belong to, potentially exposing sensitive data across organizations.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the POST /api/tooljet-db/organizations/:organizationId/join endpoint. The root cause involves three combined flaws: (1) the JOIN_TABLES ability is granted unconditionally to all authenticated users without role checks, (2) the OrganizationAuthGuard with isUserNotMandatory=true bypasses strict workspace-membership validation, and (3) the service uses the path :organizationId for data retrieval while authentication is evaluated against the header/token org, decoupling authn/authz from the data source. An attacker with low-privilege credentials (end-user) can craft a request with their own workspace in the tj-workspace-id header and a victim workspace ID in the path, then retrieve arbitrary tables if they know the table UUID. Cross-tenant reads require knowledge of internal-table UUIDs; within-tenant escalation requires only the attacker's own table IDs. Patched in v3.16.44 and later.
Affected products
- ToolJet ToolJet Database before v3.16.44
Timeline
- 2026-08-07: disclosed: GHSA-7vj5-wxfm-gmfq published
- 2026-08-31: advisory: NVD published CVE-2026-82869