CVE-2026-73068 ToolJet CVE debrief

Who should care

Defenders responsible for systems using ToolJet, especially those managing internal tools and workflows, should assess exposure and apply the patch to prevent unauthorized data access and manipulation.

Why it matters

CVE-2026-73068 is a medium-severity vulnerability in ToolJet that allows authenticated users to bypass authorization and access or manipulate table data across different tenants. Defenders should prioritize verifying exposure, applying the patch, and monitoring for suspicious activity to prevent data breaches and unauthorized system changes.

• Disclosure of sensitive table data across tenant boundaries.
• Unauthorized creation, alteration, or deletion of tables.
• Potential data breaches due to improper authorization.
• Verification of system configurations and patch application priority.

Technical summary

The ToolJet Database HTTP API does not properly verify caller membership for :organizationId URL path values, allowing authenticated users to target other workspaces and perform unauthorized actions such as disclosing table names, schemas, and rows, and creating, altering, or dropping tables across tenant boundaries. This vulnerability is due to insufficient authorization checks in the API, which can be exploited by setting the tj-workspace-id header to the user's own workspace and targeting another workspace. The issue is addressed in ToolJet version 3.20.207-lts, where proper authorization checks have been implemented to prevent such unauthorized actions.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, especially for systems using ToolJet versions prior to 3.20.207-lts.

Recommended defensive actions

• Verify exposure by checking current ToolJet version and reviewing system configurations.
• Apply the patch by updating to ToolJet version 3.20.207-lts or later.
• Review and restrict access to the ToolJet Database HTTP API.
• Monitor for suspicious activity related to table management routes.
• Perform a thorough review of system configurations and patch application.
• Track exceptions and retest remediated assets.
• Document evidence of verification and remediation efforts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish specific exploitation instances or business impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.