Description

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T09:17:08.453Z",
  "pubdate": "2026-08-31T09:17:08.453Z",
  "executiveSummary": "This vulnerability is a Broken Object Level Authorization (BOLA) flaw present in ToolJet versions prior to 3.16.208. The issue resides within the tooljet-db endpoints, which fail to verify if an authenticated user is authorized to access the specific organization defined by the organizationId parameter.\nBy manipulating the organizationId, an attacker with valid Builder-level credentials can perform unauthorized cross-tenant operations. This bypasses multi-tenancy logical isolation, granting the attacker full CRUD (Create, Read, Update, Delete) capabilities over database tables belonging to other organizations.\nThe risk implication is critical, as it facilitates unauthorized data exfiltration, database schema corruption, and permanent data loss for any organization within the affected instance. Exploitation is trivial, requiring only a valid authenticated session within the platform and knowledge of a target organization's ID, which can be harvested through publicly accessible application endpoints.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement server-side authorization checks on the server-side API endpoints responsible for managing tooljet-db schemas. Specifically, the backend logic trusts the organizationId parameter provided in the API request path without validating the requester's membership or ownership status relative to that ID.\nIn a secure multi-tenant architecture, the backend must verify the relationship between the authenticated user's session token and the resource identified by the URL parameter. In ToolJet versions before 3.16.208, the application omits this verification step, treating the organizationId as a purely functional identifier rather than a security boundary.\nThe attack flow follows a structured exploitation path: First, the attacker identifies a victim organization's ID. This is achieved by querying public-facing application endpoints that expose organization metadata. Second, the attacker interacts with the tooljet-db API endpoints by injecting the harvested organizationId into the request path. Because the system fails to validate if the attacker belongs to the target organization, the API backend processes the request as if the attacker were a legitimate member.\nThis allows for a wide range of malicious activities: attackers can disclose sensitive table schemas, execute unauthorized CREATE commands to plant malicious tables, or perform DELETE/DROP operations to purge data from the victim's database instance. Since these actions occur at the database layer, the impact is comprehensive, ranging from total data exfiltration of private schemas to the complete destruction of the target's data environment. No special network positioning is required; the attacker only needs standard Builder-level authenticated access to the ToolJet platform."
}