CVE-2026-73068

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-73068

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73068.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-73068

Aliases

GHSA-h47x-ffhc-xqh8

Published

2026-08-11T15:02:13.073Z

Modified

2026-08-15T11:30:53.204364542Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Summary

ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables

Details

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, while server/src/modules/tooljet-db/ability/index.ts grants VIEWTABLES, VIEWTABLE, and JOIN_TABLES without binding them to the path organization. An authenticated user can set tj-workspace-id to the user's own workspace and target another workspace through GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and the related table-management routes, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.

Database specific

{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73068.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/tooljet/tooljet

Affected ranges

Type

GIT

Repo

https://github.com/tooljet/tooljet

Events

Introduced

e7f4335aa61d492ed8382929b7af0bbec40af1d4

Fixed

4c1dbef7487354bd4a2b5e1c633381ea783bf879

Fixed

e7f4335aa61d492ed8382929b7af0bbec40af1d4

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.20.207-lts"
        },
        {
            "last_affected": "3.20.207-lts"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.20.207-lts

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73068.json"