Executive brief
ToolJet is a low-code platform for building internal tools and dashboards. A workspace administrator in one workspace can manipulate (create, view, delete) database tables in other unrelated workspaces by bypassing authorization checks. This allows an attacker to corrupt or delete critical database schemas belonging to other organizations without legitimate access.
Technical details
The vulnerability is an authorization bypass (CWE-639) in ToolJet's database table management API endpoints. The affected routes authenticate the caller using JwtAuthGuard and check role-based permissions against the authenticated user's current workspace. However, the underlying table operation handlers receive the organizationId directly from the URL path parameter without validating that it matches the caller's authenticated workspace ID. An authenticated workspace admin can craft requests to `/api/tooljet-db/organizations/{victimWorkspaceId}/table*` endpoints with a victim workspace ID, and since the authentication guard only checks the caller's role in their own workspace, the operation proceeds against the unintended target. A PoC demonstrates successful creation and deletion of tables in inaccessible workspaces. The issue was patched in v3.16.208.
Affected products
- ToolJet ToolJet before v3.16.208
Timeline
- 2026-08-31: disclosed: Advisory published on NVD and GitHub