Skip to content
feed: live
>_0dayNews
CVE Record
[ CRITICAL ]CVE-2026-82874

ToolJet organizationId Path Not Validated in TooljetDB Endpoints

ToolJet before v3.16.208 does not verify organizationId path parameters, letting any authenticated Builder read or modify other organizations' database tables.

cat cve-2026-82874.json
Vendor
ToolJet
Product
ToolJet
CVSS
9.9
EPSS (exploit probability)
0.3%
Status
patched
Published
Source
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-w3hx-rg9g-mw5c

ToolJet before v3.16.208 fails to validate that the organizationId in tooljet-db endpoint path parameters matches the authenticated user’s actual workspace. Any authenticated Builder-role user can target arbitrary organization IDs and perform read, write, and delete operations against other organizations’ ToolJet DB tables.

Severity: CVSS 9.9 critical. Authenticated, low-privilege access to one ToolJet workspace is sufficient to reach all other workspaces on the same instance.

Affected versions: ToolJet before v3.16.208.

Fixed in: ToolJet v3.16.208. No documented workaround short of patching.

Part of a larger disclosure: Six additional ToolJet authorization bypass flaws were disclosed alongside this CVE on August 31, 2026: CVE-2026-82870 (CVSS 9.6), CVE-2026-82872 (CVSS 9.1), CVE-2026-82875 (CVSS 5.5), CVE-2026-82871 (CVSS 7.7), CVE-2026-82869 (CVSS 7.7), and CVE-2026-82873 (CVSS 5.0). All are patched in v3.16.208; CVE-2026-82869 additionally requires v3.16.44.

See the GitHub Security Advisory for full technical details.

Related coverage
~/articles/2026-08-31-tooljet-seven-auth-bypass-cvss-9-9
ToolJet Patches Seven Auth Flaws, Worst CVSS 9.9
● Breaking
supply chain

ToolJet Patches Seven Auth Flaws, Worst CVSS 9.9

ToolJet patches seven authorization bypass flaws, the worst rated CVSS 9.9. Any authenticated Builder can read or modify data across other organizations' ToolJet DB instances.

read →