CVE-2026-73068: ToolJet Database HTTP API cross-tenant access via organizationId path

Summary

ToolJet, an open-source platform for building internal tools and AI agents, has a broken authorization flaw in its ToolJet Database HTTP API before 3.20.207. The API checks operations against the :organizationId path value without confirming the caller belongs to that organization, while the tj-workspace-id header is only checked against the caller's own memberships. An authenticated user can therefore read table names, schemas and rows from, or create, alter, populate and drop tables in, another organization's workspace via routes such as GET /api/tooljet-db/organizations/:organizationId/tables.

Mitigation

Fixed in 3.20.207-lts.

Related items

• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database
• MediumGHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolationSimilar attack · GitHub Advisory Database
• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database