---
id: CVE-2026-73068
title: >-
  ToolJet is the open-source foundation am AI-native platform for building and
  deploying internal tools, workflows and AI agents
summary: >-
  ToolJet is the open-source foundation am AI-native platform for building and
  deploying internal tools, workflows and AI agents. Prior to 3.20.207, the
  ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts
  authorizes op…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L'
cwe:
  - CWE-639
published: '2026-08-11'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:46:02.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73068'
references:
  - url: >-
      https://github.com/ToolJet/ToolJet/commit/4c1dbef7487354bd4a2b5e1c633381ea783bf879
    label: security-advisories@github.com
  - url: 'https://github.com/ToolJet/ToolJet/pull/17298'
    label: security-advisories@github.com
  - url: 'https://github.com/ToolJet/ToolJet/releases/tag/v3.20.207-lts'
    label: security-advisories@github.com
  - url: 'https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h47x-ffhc-xqh8'
    label: security-advisories@github.com
  - url: 'https://github.com/ToolJet/ToolJet/security/advisories/GHSA-h47x-ffhc-xqh8'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0028
epssPercentile: 0.20704
ingestedAt: '2026-09-09T21:22:45.527Z'
---

## Overview

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, while server/src/modules/tooljet-db/ability/index.ts grants VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES without binding them to the path organization. An authenticated user can set tj-workspace-id to the user's own workspace and target another workspace through GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and the related table-management routes, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.