What’s Vulnerable › Vulnerabilities

CVE-2026-82871: ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-17
• Weakness: CWE-862

Description

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.

Affected products

• ToolJet: before 3.16.208 — fixed in 3.16.208

How to fix

Upgrade to a fixed version: ToolJet 3.16.208. Check the vendor advisory for mitigations.

References

• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xqqj-pfc2-vf48
• https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-organization-data-read-via-database-routes
• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xqqj-pfc2-vf48

Get alerted when CVE-2026-82871 or the next vulnerability affects your stack