CVE-2026-73068
Received Received - Intake

Unauthorized Database Access in ToolJet Prior to 3.20.207

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, while server/src/modules/tooljet-db/ability/index.ts grants VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES without binding them to the path organization. An authenticated user can set tj-workspace-id to the user's own workspace and target another workspace through GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and the related table-management routes, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73068
EUVD
EUVD-2026-56186

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tooljet tooljet to 3.16.208 (exc)
tooljet tooljet 3.20.207-lts

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73068 is a cross-tenant broken access control vulnerability in ToolJet's Database (tooljet-db) component. It allows authenticated users to access another organization's tables by manipulating the organization ID in the URL path. The system authorizes operations based on the URL path's organization ID without verifying if the user belongs to that organization. The JwtAuthGuard only checks the tj-workspace-id header against the user's own memberships, while the tooljet-db CASL ability grants unconditional access to view and join tables.

Detection Guidance

To detect this vulnerability, check ToolJet server logs for unauthorized access attempts to /api/tooljet-db/organizations/:organizationId endpoints with mismatched tj-workspace-id headers. Look for requests where the tj-workspace-id does not match the organizationId in the URL path.

Impact Analysis

An attacker could exploit this to enumerate tables, disclose schemas, read rows (including sensitive data), and perform DDL operations like creating, altering, or dropping tables in another organization's database. This could lead to data leaks, unauthorized modifications, or complete database compromise across tenant boundaries.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, reputational damage, and loss of trust due to unauthorized data exposure or modification.

Mitigation Strategies

Immediately upgrade ToolJet to version 3.20.207-lts or later. Ensure the OrganizationValidateGuard is properly configured to validate organization IDs against user memberships for all tooljet-db routes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73068. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart