Description

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-31T09:17:08.610Z",
  "pubdate": "2026-08-31T09:17:08.610Z",
  "executiveSummary": "An authorization bypass vulnerability exists within ToolJet prior to version 3.16.208, specifically affecting the TooljetDB controller endpoints.\nThe flaw allows authenticated users to perform unauthorized actions across different workspaces by manipulating the 'organizationId' parameter within the URL path.\nThis vulnerability is categorized as an Insecure Direct Object Reference (IDOR) or a broken access control issue, as the application fails to validate the relationship between the authenticated user's session and the requested organization workspace.\nAn attacker can exploit this to enumerate, create, rename, and delete database tables belonging to any organization within the instance, regardless of their own authorization level.\nThe impact is significant, potentially leading to unauthorized data exposure, catastrophic data loss, or service disruption across multiple customer workspaces.\nSuccessful exploitation requires the attacker to hold a valid, authenticated session within the application, but no administrative privileges are required to target other organizations.",
  "technicalDetails": "The root cause of this vulnerability lies in improper server-side authorization checks within the TooljetDB controller. Specifically, the application relies on the 'organizationId' provided directly in the request path to identify the target workspace for database operations.\nThe application logic fails to verify if the authenticated user has sufficient permissions or membership within the specified organization represented by the 'organizationId' parameter.\nDuring the request-handling process, the controller performs operations directly based on the user-supplied organization ID, trusting the input implicitly. This behavior bypasses mandatory workspace-level access control enforcement.\nThe attack flow proceeds as follows: 1) The attacker authenticates legitimately to the ToolJet instance using their own credentials. 2) The attacker observes API requests to TooljetDB endpoints (e.g., /api/db/tables). 3) The attacker modifies the 'organizationId' parameter in the request path to correspond to a victim's organization ID, which can often be enumerated via other application endpoints or predictable patterns. 4) The server processes the request using the attacker's authentication token but applies the operation to the target organization identified in the manipulated URL path. 5) The server executes the database command—such as table creation, deletion, or renaming—on the unauthorized target workspace.\nThis flaw exposes the backend database layer to arbitrary manipulation by any authenticated user. Because the underlying controller lacks a secondary verification step to ensure the 'organizationId' is associated with the user's active session, the attacker can traverse across workspace boundaries at will.\nPost-exploitation impact includes the potential for widespread data destruction through the deletion of tables, modification of existing database schemas, or the injection of unauthorized tables, which could be used for further malicious activities. Given the nature of TooljetDB, this vulnerability represents a complete breakdown of multi-tenancy isolation within the platform."
}