CVE-2026-73068
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
ToolJet, an open-source platform for building internal tools, prior to version 3.20.207 has a vulnerability in the ToolJet Database HTTP API that authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. An authenticated user can set tj-workspace-id to their own workspace and target another workspace, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.
Risk Assessment
Risk of tenant isolation breach, potentially leading to data disclosure or unauthorized changes in databases. The attack requires an authenticated user but no special privileges.
Recommendation
Update ToolJet to version 3.20.207-lts or later. Audit permission configurations and monitor API access logs.
Original NVD description (English source)
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, while server/src/modules/tooljet-db/ability/index.ts grants VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES without binding them to the path organization. An authenticated user can set tj-workspace-id to the user's own workspace and target another workspace through GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and the related table-management routes, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.