Description
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ToolJet | ToolJet | < 3.16.208 | 3.16.208 |
References
- GitHub Security Advisory (GHSA-2jhv-482p-4php) vendor-advisory
- VulnCheck Advisory: ToolJet before v3.16.208 Cross-Workspace Authorization Bypass third-party-advisory