PT-2026-83747 · Tooljet · Tooljet
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ToolJet versions prior to 3.16.208
Description
Insufficient validation of
organizationId ownership in database write and destroy routes allows users with the builder role to perform unauthorized actions on databases belonging to other organizations. Due to missing organization-resolving guards, an attacker can create, modify, or permanently delete tables and schemas across tenant boundaries on shared instances.Recommendations
Update ToolJet to version 3.16.208 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tooljet