CyberRota Analysis
AI-GeneratedToolJet versions prior to 3.16.208 are critically vulnerable due to inadequate validation of organizationId ownership, enabling users with builder roles to manipulate databases across different organizations. This flaw allows unauthorized actions such as creating, altering, or deleting tables, which can lead to data loss and integrity issues in multi-tenant environments. Organizations using ToolJet should prioritize immediate patching to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.