PT-2026-70238 · Tooljet · Tooljet
CVE-2026-73068
·
Published
2026-08-11
·
Updated
2026-08-11
CVSS v3.1
5.9
Medium
| Vector | AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
ToolJet versions prior to 3.20.207
Description
The ToolJet Database HTTP API fails to verify if the caller belongs to the organization specified in the URL path. While the
JwtAuthGuard validates the tj-workspace-id header, the system grants permissions such as VIEW TABLES, VIEW TABLE, and JOIN TABLES without binding them to the specific organization in the path. An authenticated user can manipulate the tj-workspace-id to their own workspace while targeting a different organization via the following endpoints:- GET '/api/tooljet-db/organizations/:organizationId/tables'
- GET '/api/tooljet-db/organizations/:organizationId/table/:tableName'
- POST '/api/tooljet-db/organizations/:organizationId/join'
This allows unauthorized disclosure of table names, schemas, and rows, as well as the ability to create, alter, bulk populate, or drop tables across tenant boundaries.
Recommendations
Update to version 3.20.207-lts.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tooljet