Executive brief
ToolJet is a low-code internal tool builder platform. A vulnerability in its database management API allows any user with builder permissions to create, modify, and delete tables in other organizations' databases on shared instances. An attacker can permanently destroy critical data, inject malicious records, and alter database schemas belonging to competing or unrelated tenants.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the database write and destroy routes under server/src/modules/tooljet-db/controller.ts. Routes for creating, renaming, dropping tables, adding/dropping columns, managing foreign keys, and bulk CSV uploads accept an organizationId path parameter without validating that the caller owns that organization. The JwtAuthGuard only verifies a valid session exists; no guard cross-checks the target organizationId against the caller's JWT-derived organization. Permission checks (userPermission.tjdbCRUD) evaluate only the caller's own permission group, not the target organization. Any builder-role user can exploit this by supplying an arbitrary organizationId in API requests to perform schema and data manipulation on other organizations' databases. The vulnerability is network-reachable, requires authentication (builder role minimum), and affects all shared ToolJet instances. It was patched in version 3.16.208.
Affected products
- ToolJet ToolJet < 3.16.208
Timeline
- 2026-08-07: disclosed
- 2026-08-31: advisory
- 2026-08-31: patched: Fixed in version 3.16.208