ToolJet before version 3.16.208 does not verify that the organizationId passed in table‑management API requests matches the authenticated user’s workspace. This omission permits a workspace administrator to create, view, or delete database tables in any other workspace by simply replacing the organizationId parameter, effectively bypassing authorization controls. The flaw is a classic example of CWE‑639 – Authorization Bypass Through User-Controlled Key.

All installations of ToolJet running any version older than 3.16.208 are susceptible. The vulnerability affects the core workspace management API and any components that rely on it for database table operations.

The CVSS score of 7.1 indicates a high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote API call made by an authenticated workspace administrator; the attacker needs only workspace admin credentials, no higher privilege or physical access. Once exploited, the attacker can compromise data confidentiality and integrity across workspaces and potentially disrupt application functionality. The lack of a known public exploit does not diminish the risk, as the required conditions are commonly encountered in multi‑tenant deployments.