CyberRota Analysis
AI-GeneratedToolJet versions prior to 3.16.208 are vulnerable to an authorization bypass in the TooljetDB controller, allowing authenticated users to manipulate the organizationId parameter in URL requests. This flaw enables users to enumerate, create, rename, and delete TooljetDB tables across any workspace, posing a risk of unauthorized data access and manipulation. Organizations using affected versions should prioritize patching to mitigate potential data breaches and maintain workspace integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.