ToolJet Patches Seven Auth Flaws, Worst CVSS 9.9

Seven authorization bypass vulnerabilities in ToolJet, the open-source low-code platform widely used for internal tooling, were disclosed August 31 via GitHub security advisories. Patches confirmed available. The most severe, CVE-2026-82874, scores CVSS 9.9 critical.

The common thread

Across multiple ToolJet endpoints, the platform accepted an organizationId path parameter without verifying it matched the authenticated user’s actual workspace. Result: authenticated users, some with only Builder-level access, could target other organizations’ databases by substituting a different org ID in the request path.

Critical flaws (CVSS 9.0 and above)

CVE-2026-82874 — CVSS 9.9. ToolJet before v3.16.208 fails to validate that the organizationId in tooljet-db endpoint paths belongs to the authenticated user’s workspace. Any authenticated Builder can read, write, or delete rows in another organization’s ToolJet DB tables. Patched in v3.16.208.

CVE-2026-82870 — CVSS 9.6. Builder-role users can create, alter, or drop tables in other organizations via ToolJet’s DB write and destroy routes, which do not verify organizationId ownership. Patched in v3.16.208.

CVE-2026-82872 — CVSS 9.1. Workspace admin privileges do not stop at the admin’s own organization. ToolJet DB table operations, including creation and deletion, are available across workspace boundaries. Patched in v3.16.208.

CVE-2026-82875 — CVSS 5.5. TooljetDB controller endpoints accept organizationId from the URL path without checking it against the authenticated session. Patched in v3.16.208.

High-severity flaws

CVE-2026-82871 — CVSS 7.7. Any authenticated user, regardless of role, can read table schemas and row data belonging to other organizations via database read routes. No elevated role required. Patched in v3.16.208.

CVE-2026-82869 — CVSS 7.7. A privilege escalation in ToolJet Database’s join_tables endpoint grants JOIN_TABLES capability to all authenticated users without role or workspace verification. Patched in v3.16.44.

Medium-severity

CVE-2026-82873 — CVSS 5.0. The POST /api/v2/resources/export endpoint lacks organization membership checks, allowing any authenticated user to disclose TooljetDB table schemas across workspace boundaries. Affects ToolJet through 3.0.0-ee-beta.2. Patched in v3.16.208.

Exploitation status

No confirmed exploitation in the wild as of publication. The advisories carry no indication of observed abuse. Confidence: unconfirmed.

Who is affected

Organizations running self-hosted ToolJet in multi-tenant configurations. Environments where a single ToolJet instance serves multiple separate teams or clients carry the highest risk. The advisories do not address SaaS-hosted instances; ToolJet users on the managed cloud platform should check vendor communications directly.

What to do

Update to ToolJet v3.16.208. CVE-2026-82869 specifically requires v3.16.44 or later; v3.16.208 satisfies both. No documented workaround short of patching. If patching cannot happen immediately: restrict ToolJet access to trusted internal networks, audit Builder-role membership across workspaces, and treat any multi-tenant ToolJet deployment as potentially compromised until updated.

The advisories were published by ToolJet on August 31, 2026, and are available in full on the ToolJet GitHub security advisory tracker.

---

Related coverage: ash_phoenix Patches Four Auth-Bypass Flaws — JFrog Artifactory Flaw Gives Unauthenticated Admin Access — PaperCut Issues Second Patch as Bypasses Found