ToolJet versions up to 3.0.0-ee-beta.2 expose an authentication bypass in the POST /api/v2/resources/export endpoint. Through this flaw, a user can supply an organization_id parameter in the request body and retrieve TooljetDB table schemas from workspaces they are not authorized to view. Additionally, the endpoint allows an attacker to export application definitions that should be protected by per–app authorization, leading to disclosure of potentially sensitive configuration data. The vulnerability is a direct authorization bypass that compromises the confidentiality of database schemas and application setups, thereby enabling an attacker to gain insight into the underlying database structure and code that should remain private.

The vulnerability affects all installations of ToolJet up to and including version 3.0.0-ee-beta.2. Any deployment running this build or earlier is susceptible. The affected product is the ToolJet application server, regardless of deployment size or environment.

The CVSS score of 5.3 indicates a moderate severity impact, while the EPSS score is not available, so the likelihood of immediate exploitation is uncertain. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with API access; the attacker can remotely send a crafted POST request to the export endpoint to harvest schema and definition data across workspace and permission boundaries. Because the flaw is limited to authorized users and does not involve code execution, the attack surface is primarily confined to the API layer.