CVE-2026-55411

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.20.1780-lts

Description An authenticated user can decrypt data-source secrets belonging to any other organization, leading to a cross-tenant confidentiality breach. This occurs because the endpoint 'POST /api/data-sources/decrypt' lacks the protection of ValidateDataSourceGuard and does not receive the calling @User() context. Additionally, the CredentialsService.getValue() function retrieves credentials using only the credential id provided in the request body without verifying organization scoping.

Recommendations Update to version 3.20.1780-lts. As a temporary workaround, restrict access to the 'POST /api/data-sources/decrypt' endpoint to minimize the risk of exploitation.