Description

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-31T09:17:08.160Z",
  "pubdate": "2026-08-31T09:17:08.160Z",
  "executiveSummary": "ToolJet versions prior to v3.16.208 are susceptible to a critical Broken Object Level Authorization (BOLA) vulnerability within the database management API.\nThe vulnerability originates from a failure to validate that the organizationId parameter in API requests corresponds to the authenticated user's authorized workspace.\nAn attacker possessing workspace administrator privileges in one organization can manipulate the organizationId parameter to perform unauthorized operations, including the creation, viewing, and deletion of database tables within any other workspace instance.\nThis flaw effectively bypasses multi-tenancy logical isolation, posing a severe risk to data integrity, confidentiality, and availability.\nExploitation requires an authenticated session with administrative privileges within at least one valid workspace, allowing the adversary to escalate their scope of impact horizontally across the entire platform infrastructure.",
  "technicalDetails": "The vulnerability resides in the server-side API implementation responsible for ToolJet DB table management. The root cause is a deficiency in the authorization logic, where the application trusts the user-supplied organizationId parameter without cross-referencing it against the session's security context or the authenticated user's organizational memberships.\nIn a secure multi-tenant architecture, the backend should derive the organization scope strictly from the authenticated session tokens or associated metadata rather than relying on client-supplied identifiers.\nThe attack flow proceeds as follows: 1) The adversary authenticates to ToolJet with valid credentials for an organization they legitimately control. 2) The adversary intercepts or crafts an API request directed at table-management endpoints (e.g., table creation, deletion, or retrieval). 3) The adversary modifies the organizationId parameter within the JSON payload or URI parameters, replacing their legitimate ID with a target ID of a different workspace. 4) The server processes the request using the provided ID, failing to perform a check to ensure the requester has administrative permissions over the targeted organization ID. 5) The database backend executes the requested administrative operation against the unauthorized workspace, resulting in unauthorized data modification or total data loss.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA). Because the application allows an authenticated user to perform administrative operations across organizational boundaries, it violates the principle of least privilege and destroys the logical separation of tenant data.\nThe impact is significant: an attacker could potentially delete production databases, exfiltrate sensitive schema information, or inject malicious tables to prepare for further exploitation. The vulnerability affects all ToolJet DB functionality governed by these insecure API endpoints in versions before v3.16.208. The exposure is limited to authenticated users, but the presence of any user with 'workspace admin' privileges effectively grants them cross-tenant control, creating a high-risk environment for multi-tenant deployments."
}