by Kastro
Paper/Archive/CVE-2026-82874

CVE-2026-82874

ToolJet ToolJet — ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
37
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 38.5.385 × 207.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

Affected

ProductAffectedFixed inSource
ToolJet< 3.16.2083.16.208CNA

Scores by source

VulnCheck (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/ToolJet/ToolJet/security/advisories/GHSA-w3hx-rg9g-mw5cwriteupvulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-authorization-bypass-via-tooljet-db