ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

ToolJet versions before v3.16.208 contain a critical cross-tenant authorization bypass vulnerability in its tooljet-db endpoints. The flaw allows any authenticated Builder user to access, modify, and delete database tables belonging to other organizations without authorization. The vulnerability stems from a failure to validate that the authenticated user belongs to the organization specified in the organizationId path parameter. Attackers can harvest victim organization IDs from public app endpoints and then exploit schema operation endpoints to read table schemas, insert malicious tables, corrupt existing schemas, or permanently delete victim data. This represents a significant multi-tenant isolation failure that could lead to data breaches and data destruction across organizational boundaries. A fix has been released in ToolJet v3.16.208.