CVE-2026-55411: ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credentialid is supplied in the request body. Unlike every neighbouring data-source route, this handler is not protected by ValidateDataSourceGuard, does not receive the calling @User(), and the underlying CredentialsService.getValue() looks the credential up by id only, with no organization scoping. As a result, any authenticated user of any organization can decrypt the data-source secrets of any other organization by supplying that organization's credentialid — a cross-tenant confidentiality breach. This vulnerability is fixed in 3.20.1780-lts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJetto a version that resolves this vulnerability.Fixed in 3.20.1780-lts - Compensating control
As a temporary mitigation until upgrading, restrict access to the POST /api/data-sources/decrypt endpoint so only authorized users/tenants can reach it (e.g., via network ACL/firewall or an upstream gateway rule keyed to the caller’s tenant/org).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55411?
The severity of CVE-2026-55411 is rated medium with a score of 6.8.
How can I fix CVE-2026-55411?
To fix CVE-2026-55411, update ToolJet to version 3.20.1780-lts or later.
What type of vulnerability is CVE-2026-55411?
CVE-2026-55411 is an IDOR (Insecure Direct Object Reference) vulnerability affecting credential decryption.
Who is affected by CVE-2026-55411?
Any authenticated user of ToolJet prior to version 3.20.1780-lts can be affected by CVE-2026-55411.
What impact does CVE-2026-55411 have on data security?
CVE-2026-55411 allows any authenticated user to decrypt and access another organization's data-source secrets, potentially compromising sensitive information.