If you notice a security vulnerability, please let the team know by sending an email to security@tooljet.com.
Security: ToolJet/ToolJet
Security
SECURITY.md
-
Cross-workspace / privilege-bypass IDOR in the ToolJet Database join_tables endpointGHSA-7vj5-wxfm-gmfq published
Aug 7, 2026 by shubh22Moderate -
ToolJet Database write/destroy routes trust a client-supplied organizationId with no ownership check, allowing any builder-role user to create, alter, or drop tables in any other organization's databaseGHSA-xr3w-r926-xfmm published
Aug 7, 2026 by shubh22Moderate -
ToolJet Database read routes have no per-organization authorization at all, allowing any authenticated user (any role) to read any other organization's table schemas and row dataGHSA-xqqj-pfc2-vf48 published
Aug 7, 2026 by shubh22Moderate -
Workspace admin can manage ToolJet DB tables in another workspace by replacing path organizationIdGHSA-2jhv-482p-4php published
Aug 7, 2026 by shubh22Moderate -
Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tablesGHSA-h47x-ffhc-xqh8 published
Aug 7, 2026 by shubh22Moderate -
Credential decryption (IDOR) in POST /api/data-sources/decrypt - authenticated user can decrypt data-source secretsGHSA-x7qj-hfg8-p4cw published
Jun 12, 2026 by shubh22Moderate -
ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code ExecutionGHSA-jgmf-cw3v-r98x published
Jun 12, 2026 by shubh22Critical -
ToolJet Cloud - SSRF to Azure Cloud Infrastructure CompromiseGHSA-h49f-mhmm-jx4w published
Jun 12, 2026 by shubh22High -
Cross-workspace TooljetDB schema disclosure and intra-workspace cross-app export via /api/v2/resources/exportGHSA-pqfh-276q-w3cp published
Aug 7, 2026 by shubh22Moderate -
Cross-tenant authorization bypass in tooljet-db schema operations allows arbitrary read/write/destruction across organization boundariesGHSA-w3hx-rg9g-mw5c published
Aug 7, 2026 by shubh22Moderate
Learn more about advisories related to ToolJet/ToolJet in the GitHub Advisory Database