CVE-2026-82871
ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
- State
- Published
- Severity
- 8.2 High
- Published
- Aug 31, 2026
- Updated
- Sep 17, 2026
- Reserved
- Aug 31, 2026
Description
ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | VulnCheck |
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
ToolJetToolJet |
|
References
- GitHub Security Advisory (GHSA-xqqj-pfc2-vf48)vendor-advisory
- VulnCheck Advisory: ToolJet before v3.16.208 Cross-Organization Data Read via Database Routesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.