CVE-2026-82874
ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
- State
- Published
- Severity
- 9.4 Critical
- Published
- Aug 31, 2026
- Updated
- Sep 17, 2026
- Reserved
- Aug 31, 2026
Description
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
ToolJetToolJet |
|
References
- GitHub Security Advisory (GHSA-w3hx-rg9g-mw5c)vendor-advisory
- VulnCheck Advisory: ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-dbthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.