CVE-2026-82873: ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB table schemas across workspace boundaries and export app definitions across granular permission boundaries. Attackers can supply a body-provided organizationid parameter to access schemas from other workspaces, or bypass per-app authorization gates to export restricted app definitions within their workspace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJet (TooljetDB)to a version that resolves this vulnerability.Fixed in 3.0.0-ee-beta.2 - Compensating control
Mitigate by restricting access to the ToolJet POST /api/v2/resources/export endpoint so authenticated users cannot use it to export data across workspace boundaries or beyond granular permission gates.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be an authenticated ToolJet user with low-level privileges. No user interaction is required, and the vulnerable endpoint is reachable over the network.
Who is exposed to cross-workspace schema disclosure?
Organizations using multiple ToolJet workspaces are exposed if an authenticated user can reach the export endpoint. An attacker can provide an organization_id in the request body to retrieve TooljetDB table schemas belonging to another workspace.
Can this affect restricted applications within the attacker's own workspace?
Yes. The export endpoint can bypass per-application authorization gates, allowing an authenticated user to export app definitions that are restricted by granular permissions within their workspace.