ToolJet GHSA: Missing OrgId check allows cross-workspace DB table mgmt

Vulnerability Key Information Summary Vulnerability Overview Title: Workspace admin can manage ToolJet DB tables in another workspace by replacing path organizationId ID: GHSA-2jhv-482p-4qhp Severity: Moderate (CVSS 6.8 / 10) Description: In ToolJet CE v3.26.189-lts and v3.26.289-lts, an admin of Workspace A can create, view, and delete ToolJet DB tables in another workspace by replacing the in the path with the ID of Workspace B. The affected endpoints do not validate that the in the path matches the ID of the caller's authenticated workspace. Impact Affected Versions: < v3.16.208 Fixed Version: v3.16.208 Impact: Workspace A admins can perform cross-workspace ToolJet DB table management operations (create/drop tables), leading to cross-workspace integrity and availability issues. Remediation Upgrade to v3.16.208 or a newer version. Fix details: Added validation in the affected endpoints to ensure that the in the path matches the ID of the caller's authenticated workspace. PoC Code / Exploit Code Affected Endpoints Key Files (Attachments) Reproduction Steps (High-Level) 1. Start local ToolJet CE v3.26.189-lts or v3.26.289-lts 2. Create Workspace A and Workspace B 3. Create a regular attacker admin in Workspace B 4. Verify that the attacker cannot switch to Workspace B 5. Verify that Workspace B is not present in the attacker's organization list 6. Send 7. Verify that the marked table exists in Workspace B 8. Verify that the admin can view the marked table in Workspace B 9. Send 10. Verify that the marked table has been deleted from Workspace B Evidence JSON Non-Claims Public ToolJet tenants were not tested ToolJet Cloud tenants were not tested Third-party services were not engaged Unauthenticated access to ToolJet DB is not claimed

Goal Reached Thanks to every supporter — we hit 100%!

ToolJet GHSA: Missing OrgId check allows cross-workspace DB table mgmt

More from this source