A critical authorization bypass vulnerability in ToolJet allows workspace administrators to perform unauthorized database operations across different workspaces.

This is a CWE-639 Authorization Bypass Through User-Controlled Key vulnerability. An authenticated workspace administrator can manipulate the organizationId parameter in API requests to interact with database tables belonging to workspaces they are not authorized to access.

The ability for a workspace administrator to create, view, and delete database tables in unauthorized workspaces poses a severe risk to data integrity and confidentiality. Given the CVSS score of 9.1, this vulnerability permits cross-workspace data manipulation, which could lead to unauthorized data exposure or total loss of business information within the ToolJet platform.

Immediate Action: Upgrade your ToolJet instance to version 3.16.208 or later to ensure proper validation of the organizationId parameter.

Proactive Monitoring: Review API access logs for anomalous requests where the organizationId parameter does not align with the authenticated user's assigned workspace.

Compensating Controls: Implement strict network access controls to limit access to the API endpoints and ensure that administrative actions are performed only from trusted management interfaces.

Public Exploit Available: No (exploit_available is false).

The security of multi-tenant environments relies on strict authorization boundaries. Because this vulnerability allows a malicious or compromised workspace administrator to breach these boundaries and manipulate sensitive database assets in other workspaces, immediate patching is required. Organizations should prioritize updating to version 3.16.208 to restore proper isolation and prevent unauthorized administrative access.