CVE-2026-82870: ToolJet before v3.16.208 Cross-Tenant Database Manipulation

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-17
Weakness: CWE-639

Description

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.

Affected products

ToolJet: before 3.16.208 — fixed in 3.16.208

How to fix

Upgrade to a fixed version: ToolJet 3.16.208. Check the vendor advisory for mitigations.

References

https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xr3w-r926-xfmm
https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-database-manipulation
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xr3w-r926-xfmm

Get alerted when CVE-2026-82870 or the next vulnerability affects your stack