Npcmike

**Name of the Vulnerable Software and Affected Versions** ToolJet versions prior to 3.20.1780-lts **Description** An authenticated user can decrypt data-source secrets belonging to any other organization, leading to a cross-tenant confidentiality breach. This occurs because the endpoint 'POST /api/data-sources/decrypt' lacks the protection of ValidateDataSourceGuard and does not receive the calling `@User()` context. Additionally, the `CredentialsService.getValue()` function retrieves credentials using only the `credential id` provided in the request body without verifying organization scoping. **Recommendations** Update to version 3.20.1780-lts. As a temporary workaround, restrict access to the 'POST /api/data-sources/decrypt' endpoint to minimize the risk of exploitation.