What’s Vulnerable › Vulnerabilities

CVE-2026-82874: ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-17
• Weakness: CWE-639

Description

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

Affected products

• ToolJet: before 3.16.208 — fixed in 3.16.208

How to fix

Upgrade to a fixed version: ToolJet 3.16.208. Check the vendor advisory for mitigations.

References

• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-w3hx-rg9g-mw5c
• https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-authorization-bypass-via-tooljet-db

Get alerted when CVE-2026-82874 or the next vulnerability affects your stack