{"data":{"id":"a66590ef-6734-4dba-9eea-52b29633e14e","title":"CVE-2026-55411: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI…","summary":"ToolJet, an open-source platform for building internal tools and AI agents, has a cross-tenant flaw before 3.20.1780-lts. The authenticated endpoint POST /api/data-sources/decrypt returns decrypted plaintext for any credential_id supplied in the request body, because the handler lacks ValidateDataSourceGuard and the CredentialsService.getValue() lookup has no organization scoping. Any authenticated user can therefore decrypt another organization's data-source secrets.","solution":"Fixed in 3.20.1780-lts.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55411","publishedAt":"2026-06-25T17:16:41.823Z","cveId":"CVE-2026-55411","cweIds":["CWE-639","CWE-863"],"cvssScore":"6.8","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ToolJet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ToolJet decrypt endpoint exposes data-source credentials across organizations","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","attackVector":"adjacent","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00199,"epssCheckedAt":"2026-11-09T18:09:53.615Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-10T00:11:42.946Z","patchAvailable":null,"disclosureDate":"2026-06-25T17:16:41.823Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}