CVE-2026-55411

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plaintext for any credential whose credential_id is supplied in the request body. Unlike every neighbouring data-source route, this handler is not protected by ValidateDataSourceGuard, does not receive the calling @User(), and the underlying CredentialsService.getValue() looks the credential up by id only, with no organization scoping. As a result, any authenticated user of any organization can decrypt the data-source secrets of any other organization by supplying that organization's credential_id — a cross-tenant confidentiality breach. This vulnerability is fixed in 3.20.1780-lts.

• CWE-639
• CWE-863

• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-x7qj-hfg8-p4cw
• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-x7qj-hfg8-p4cw

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55406Buffa is a pure-Rust Protocol Buffers implementation with fi…5.9
• CVE-2026-55407Buffa is a pure-Rust Protocol Buffers implementation with fi…6.3
• CVE-2026-55408Koodo Reader is an ebook reader. In version 2.3.0 and earlie…8.4
• CVE-2026-55409Filament is a collection of full-stack components for accele…7.6
• CVE-2026-5541A vulnerability was found in code-projects Simple Laundry Sy…4.3
• CVE-2026-55410NocoBase is an AI-powered no-code/low-code platform for buil…6.7
• CVE-2026-55412ToolJet is the open-source foundation am AI-native platform …8.3
• CVE-2026-55413ToolJet is the open-source foundation am AI-native platform …9.4
• CVE-2026-55415datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-55417Chevereto is a self-hosted media-sharing platform. Starting …6.9
• CVE-2026-55418FastGPT is an open source AI knowledge base platform. Prior …8.6
• CVE-2026-5542A vulnerability was determined in code-projects Simple Laund…4.3