EUVD-2026-39470Severity by source
AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
AV:N chosen over AV:A because ToolJet's API is typically internet-exposed; PR:L confirmed by authentication requirement; S:C reflects cross-tenant boundary violation.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credential_id is supplied in the request body. Unlike every neighbouring data-source route, this handler is not protected by ValidateDataSourceGuard, does not receive the calling @User(), and the underlying CredentialsService.getValue() looks the credential up by id only, with no organization scoping. As a result, any authenticated user of any organization can decrypt the data-source secrets of any other organization by supplying that organization's credential_id - a cross-tenant confidentiality breach. This vulnerability is fixed in 3.20.1780-lts.
AnalysisAI
Cross-tenant credential decryption in ToolJet prior to 3.20.1780-lts allows any authenticated user to retrieve plaintext data-source secrets belonging to any other organization on the same instance. The POST /api/data-sources/decrypt endpoint omits the ValidateDataSourceGuard present on all neighboring routes and performs no organization-scoped lookup, meaning a valid session from any tenant is sufficient to exfiltrate database passwords, API keys, and other stored secrets across tenant boundaries. No public exploit has been identified at time of analysis, but the attack is mechanically trivial for any user with a valid account and knowledge of a target credential_id.
Technical ContextAI
ToolJet is a NestJS-based open-source platform for building internal tools and workflows. Its data-source layer stores encrypted credentials via a CredentialsService. The affected handler, POST /api/data-sources/decrypt, calls CredentialsService.getValue() with a caller-supplied credential_id and returns the decrypted plaintext. Unlike adjacent data-source routes that apply the ValidateDataSourceGuard NestJS guard and inject the calling @User() context to enforce organization scoping, this endpoint was left unguarded and context-free. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the caller fully controls the lookup key (credential_id) and the service performs no authorization check to verify the credential belongs to the caller's organization. Affected product is identified by CPE cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*, covering all releases before 3.20.1780-lts.
RemediationAI
Upgrade ToolJet to version 3.20.1780-lts or later, which is the vendor-released patch that adds ValidateDataSourceGuard and correct organization-scoped authorization to the POST /api/data-sources/decrypt endpoint. The authoritative advisory is at https://github.com/ToolJet/ToolJet/security/advisories/GHSA-x7qj-hfg8-p4cw. If immediate patching is not possible, restrict access to the /api/data-sources/decrypt route at the reverse proxy or WAF layer to a known-safe set of internal IPs or block it entirely - note this will break data-source testing and connection-validation features for end users. As a detection measure, audit application logs for POST /api/data-sources/decrypt requests where the credential_id in the body does not belong to the requesting user's organization; anomalous cross-tenant lookups in logs may indicate prior exploitation. There is no known workaround that preserves full functionality without patching.
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that w
Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. Rated high severity (CVSS 8.8), this vuln
ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . Ra
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. Rated high severity (CVSS 8.0), this vul
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Rated high severity (CVSS
Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML v
Stored code injection in ToolJet self-hosted (prior to 3.20.178-lts) lets any authenticated builder-role user - availabl
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside t
Just like in the previous report, an attacker could steal the account of different users. Rated medium severity (CVSS 4.
CI/CD pipeline injection in ToolJet's GitHub Actions render-preview deployment workflow (versions prior to 3.20.180) all
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today