ToolJet DB Cross-Tenant Broken Access Control POC: Unauthenticated Data Exfiltration via IDOR

Vulnerability Overview Title: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables Description: The ToolJet Database (tooljet-db) HTTP API retrieves the solely from the URL path during operations, without verifying that the organization is indeed a member of the caller. only validates the header to check user membership, while CASL permissions unconditionally grant to any user of their workspace for any administrator. This leads to cross-tenant breaches of confidentiality and integrity. Impact Scope Affected Versions: < v3.16.208 Fixed Version: v3.16.208 Severity: 5.9 / 10 CVSS v3 Base Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: Low Remediation Bind the path organization to the caller. For each route (unless the caller's active workspace, or resolving the organization from the session sidebar (bypassing the path), restrict CASL permissions prior to granting. Apply to read routes ( , , ) and all DDL/bulk routes. POC Code Impact Any authenticated ToolJet user (including users from unrelated workspaces) can read all internal database tables of any organization whose UUID is known (PII, confidential data, business data) and create/rename/delete/insert into these tables—cross-tenant data leakage/tampering. On ToolJet Cloud, this breaks the isolation of the built-in database.

Goal Reached Thanks to every supporter — we hit 100%!

ToolJet DB Cross-Tenant Broken Access Control POC: Unauthenticated Data Exfiltration via IDOR

More from this source