CVE-2026-82875: ToolJet before v3.16.208 Authorization Bypass via organizationId

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-17
Weakness: CWE-863

Description

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

Affected products

ToolJet: before 3.16.208 — fixed in 3.16.208

How to fix

Upgrade to a fixed version: ToolJet 3.16.208. Check the vendor advisory for mitigations.

References

https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf
https://www.vulncheck.com/advisories/tooljet-before-3.16.208-authorization-bypass-via-organizationid
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf

Get alerted when CVE-2026-82875 or the next vulnerability affects your stack