{"data":{"id":"598d3c89-4dcd-4491-b12a-907661ffbd61","title":"CVE-2026-73068: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI…","summary":"ToolJet, an open-source platform for building internal tools and AI agents, has a broken authorization flaw in its ToolJet Database HTTP API before 3.20.207. The API checks operations against the :organizationId path value without confirming the caller belongs to that organization, while the tj-workspace-id header is only checked against the caller's own memberships. An authenticated user can therefore read table names, schemas and rows from, or create, alter, populate and drop tables in, another organization's workspace via routes such as GET /api/tooljet-db/organizations/:organizationId/tables.","solution":"Fixed in 3.20.207-lts.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73068","publishedAt":"2026-08-11T16:17:37.947Z","cveId":"CVE-2026-73068","cweIds":["CWE-639"],"cvssScore":"5.9","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ToolJet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ToolJet Database HTTP API cross-tenant access via organizationId path","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","attackVector":"adjacent","attackComplexity":"low","privilegesRequired":"high","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0027,"epssCheckedAt":"2026-11-11T06:13:02.113Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T06:14:12.991Z","patchAvailable":null,"disclosureDate":"2026-08-11T16:17:37.947Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}