Executive brief
ToolJet is a low-code platform for building internal tools and dashboards. An authenticated user can bypass workspace isolation controls in ToolJet's database module (TooljetDB) by manipulating URL parameters, allowing them to enumerate, create, rename, and delete tables belonging to other organizations on the same instance. This breaks the multi-tenant security boundary and could result in data loss, unauthorized data access, or operational disruption across isolated workspaces.
Technical details
This is an authorization bypass vulnerability (CWE-863) in ToolJet's TooljetDB controller endpoints. The vulnerable code accepts organizationId directly from URL path parameters without validating that the authenticated user's workspace matches the requested organization. While the JwtAuthGuard validates user identity against the tj-workspace-id header, it does not enforce that the organizationId in the URL matches the authenticated user's workspace. The CASL ability factory grants read permissions (VIEW_TABLE, VIEW_TABLES, JOIN_TABLES) to all authenticated users and write permissions (CREATE_TABLE, DROP_TABLE) to any admin/builder regardless of workspace scoping. An authenticated user can exploit this by sending requests with a valid JWT and workspace header from their own workspace, but substituting a different organization ID in the URL to access tables in other workspaces. The attack requires only low privileges (authenticated user with any role) and no user interaction. Patch available in v3.16.208.
Affected products
- ToolJet ToolJet before v3.16.208
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in v3.16.208