ToolJet EUVD-2026-39470

Exploitation requires a valid ToolJet authentication token for any account on the affected instance (PR:L per CVSS) - no elevated role or admin access is needed. The attacker must have network access to the ToolJet API; the NVD vector designates AV:A (adjacent network), but internet-exposed ToolJet deployments effectively remove this barrier. A specific credential_id from a target organization must be known or discoverable; the endpoint itself does not provide enumeration, so the attacker must obtain valid IDs through another channel (insider access, sequential ID guessing if IDs are non-random, or a separate information disclosure vulnerability). The cross-tenant confidentiality breach is only realized in multi-tenant ToolJet deployments hosting multiple organizations on the same instance - single-tenant deployments are not exposed to inter-organization credential exfiltration, though the missing guard remains an authorization gap. No non-default configuration is required; the vulnerable endpoint is present in all pre-patch ToolJet installations by default.

The NVD CVSS 6.8 vector (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects the core risk well but the AV:A designation may understate exposure: ToolJet deployments that publish the API over the internet would reduce the adjacency barrier to none. The Scope:Changed metric is correctly applied - a single compromised or malicious account in one tenant can exfiltrate secrets of entirely separate organizations, amplifying blast radius beyond the attacker's own tenant. Attack complexity is genuinely Low: once a valid session and a target credential_id are in hand, exploitation is a single authenticated HTTP POST. EPSS data was not provided in the input and KEV listing is absent, so no probabilistic exploitation estimate or confirmed active exploitation signal is available. The missing KEV entry and absence of public POC suggest targeted rather than opportunistic exploitation so far, but the low technical barrier makes this a real priority for multi-tenant ToolJet operators. Single-tenant self-hosted instances face reduced cross-organization risk but retain the authorization gap.

An attacker with a low-privileged ToolJet account on a shared instance - potentially a free-tier or guest user in their own organization - discovers or is provided a credential_id associated with another tenant's data source (e.g., through insider knowledge, enumeration of sequential IDs, or a separate information disclosure). They issue a single authenticated POST /api/data-sources/decrypt request with that credential_id and receive the full plaintext secret in the response, which they can then use to directly access the victim organization's database or third-party API. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond a standard HTTP client.