Shubh22

**Name of the Vulnerable Software and Affected Versions** ToolJet versions prior to 3.0.0-ee-beta.2 **Description** An authorization bypass exists in the 'POST /api/v2/resources/export' endpoint. Authenticated users can disclose TooljetDB table schemas across workspace boundaries or export app definitions by bypassing granular permission gates. This is achieved by providing a specific `organization id` parameter in the request body to access schemas from other workspaces or to export restricted app definitions within their own workspace. **Recommendations** Update ToolJet to a version later than 3.0.0-ee-beta.2. As a temporary mitigation, restrict access to the 'POST /api/v2/resources/export' endpoint.