Description
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ToolJet | ToolJet | < 3.16.208 | 3.16.208 |
References
- GitHub Security Advisory (GHSA-xr3w-r926-xfmm) vendor-advisory
- VulnCheck Advisory: ToolJet before v3.16.208 Cross-Tenant Database Manipulation third-party-advisory