What’s Vulnerable › Vulnerabilities

CVE-2026-82869: ToolJet Database before v3.16.44 Privilege Escalation via join_tables

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-10
• Weakness: CWE-639

Description

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.

Affected products

• ToolJet: before 3.16.44 — fixed in 3.16.44

How to fix

Upgrade to a fixed version: ToolJet 3.16.44. Check the vendor advisory for mitigations.

References

• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-7vj5-wxfm-gmfq
• https://www.vulncheck.com/advisories/tooljet-database-before-3.16.44-privilege-escalation-via-join-tables

Get alerted when CVE-2026-82869 or the next vulnerability affects your stack