CVE-2026-73068: ToolJet Auth Bypass Vulnerability

CVE-2026-73068 Overview

CVE-2026-73068 is a cross-tenant authorization bypass in ToolJet, an open-source AI-native platform for building internal tools, workflows, and AI agents. Versions prior to 3.20.207 fail to bind ToolJet Database (TJDB) HTTP API operations to the organization specified in the URL path. The JwtAuthGuard validates the tj-workspace-id header against the caller's memberships but does not verify that the caller belongs to the :organizationId in the route. An authenticated user with access to any workspace can read, create, alter, populate, or drop tables in other tenants' databases. This weakness is tracked as [CWE-639] (Authorization Bypass Through User-Controlled Key) and is fixed in version 3.20.207-lts.

Critical Impact
Any authenticated ToolJet user can enumerate table schemas, read rows, and destructively modify tables belonging to other tenants, breaking multi-tenant isolation.

Affected Products

ToolJet versions prior to 3.20.207-lts
ToolJet Database (TJDB) HTTP API (server/src/modules/tooljet-db/controller.ts)
ToolJet self-hosted multi-tenant deployments

Discovery Timeline

2026-08-11 - CVE-2026-73068 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73068

Vulnerability Analysis

The flaw resides in the ToolJet Database HTTP API controller. Routes such as GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, and POST /api/tooljet-db/organizations/:organizationId/join accept an organizationId path parameter that identifies the target tenant. Authorization is enforced through JwtAuthGuard combined with the ability layer in server/src/modules/tooljet-db/ability/index.ts. The guard verifies the caller's session against the tj-workspace-id header, and the ability layer grants VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES based on the caller's role in that workspace. Neither check compares the header workspace to the :organizationId in the URL, so a caller can authenticate against their own workspace and act against another.

Root Cause

The root cause is a missing binding between the authenticated workspace context and the tenant identifier supplied in the request path. The ability grants are attached to the caller's own membership rather than the resource owner, which is the pattern described by [CWE-639]. Read and write permissions on TJDB tables therefore apply globally across tenants for any authenticated user with equivalent role bits in their own workspace.

Attack Vector

An authenticated attacker sets the tj-workspace-id header to a workspace they legitimately belong to, then issues TJDB API calls with a victim organizationId in the path. Table-listing and table-read endpoints disclose schemas and row data. Table-management routes allow creation, alteration, bulk population, and dropping of tables in the victim tenant. Exploitation requires only valid credentials on the same ToolJet instance and network reach to the API.

typescript

     }
     const isPublicAppRequest = isEmpty(organizationId) && !isEmpty(dataQuery) && dataQuery.app.isPublic;
     const isUserLoggedin = !isEmpty(requestContext.user) && !isEmpty(organizationId);
+    const orgMismatch = !isEmpty(dataQuery) && dataQuery?.app?.organizationId !== organizationId;
 
     if (superAdmin || isAdmin || userPermission.tjdbCRUD) {
       can(

Source: ToolJet security patch commit 4c1dbef. The patch introduces an orgMismatch check that compares the resource's organizationId against the value in the request context before granting ability rules.

Detection Methods for CVE-2026-73068

Indicators of Compromise

Requests to /api/tooljet-db/organizations/:organizationId/* where the path organizationId differs from the value in the tj-workspace-id header on the same request.
Unexpected CREATE, ALTER, DROP, or bulk INSERT operations on TJDB tables originating from user accounts that do not belong to the target tenant.
Sudden enumeration bursts against GET /api/tooljet-db/organizations/:organizationId/tables from a single authenticated principal.

Detection Strategies

Enable ToolJet application access logs and forward them to a centralized log platform for correlation between tj-workspace-id, user_id, and :organizationId.
Write a detection rule that alerts when the URL path organization identifier does not match the header workspace identifier for TJDB endpoints.
Baseline normal per-user TJDB API call volumes and alert on outliers, particularly against the join and table routes.

Monitoring Recommendations

Monitor PostgreSQL audit logs on the TJDB backend for DDL statements outside expected change windows.
Track ToolJet upgrade status across environments to confirm all instances are running 3.20.207-lts or later.
Alert on new admin-role assignments in ToolJet workspaces, since role escalation amplifies the impact of this bug.

How to Mitigate CVE-2026-73068

Immediate Actions Required

Upgrade all ToolJet instances to version 3.20.207-lts or later without delay.
Rotate ToolJet session tokens and API keys after upgrade to invalidate any hijacked sessions.
Audit TJDB tables in every tenant for unauthorized schema changes, unexpected rows, or missing tables.

Patch Information

The fix is delivered in ToolJet release v3.20.207-lts and merged through pull request #17298. Details are documented in GitHub Security Advisory GHSA-h47x-ffhc-xqh8. The patch adds an orgMismatch guard that denies ability grants when the resource organization does not match the request context organization.

Workarounds

Restrict network access to the ToolJet API to trusted operators until the upgrade is applied.
Reduce user roles in shared multi-tenant deployments to remove tjdbCRUD permissions from non-essential accounts.
Deploy a reverse proxy rule that rejects TJDB API requests where the tj-workspace-id header does not equal the :organizationId path segment.

bash

# Example NGINX rule to block cross-tenant TJDB API calls
# Extract the organizationId from the URL and compare to the workspace header
location ~ ^/api/tooljet-db/organizations/([^/]+)/ {
    set $path_org $1;
    if ($http_tj_workspace_id != $path_org) {
        return 403;
    }
    proxy_pass http://tooljet_backend;
}