Skip to content
feed: live
0dayNews
CVE Record
[ CRITICAL ]CVE-2026-82874

ToolJet organizationId Path Not Validated in TooljetDB Endpoints

ToolJet before v3.16.208 does not verify organizationId path parameters, letting any authenticated Builder read or modify other organizations' database tables.

cat cve-2026-82874.json
Vendor
ToolJet
Product
ToolJet
CVSS
9.9
EPSS (exploit probability)
0.4%
Status
patched
Published
Source
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-w3hx-rg9g-mw5c

Is CVE-2026-82874 being exploited?

Not on any exploited-vulnerability catalog we track. CVE-2026-82874 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).

Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison

CVE-2026-82874 timeline

  1. First 0dayNews coveragesame day as NVD
  2. Published to NVD

Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON

ToolJet before v3.16.208 fails to validate that the organizationId in tooljet-db endpoint path parameters matches the authenticated user’s actual workspace. Any authenticated Builder-role user can target arbitrary organization IDs and perform read, write, and delete operations against other organizations’ ToolJet DB tables.

Severity: CVSS 9.9 critical. Authenticated, low-privilege access to one ToolJet workspace is sufficient to reach all other workspaces on the same instance.

Affected versions: ToolJet before v3.16.208.

Fixed in: ToolJet v3.16.208. No documented workaround short of patching.

Part of a larger disclosure: Six additional ToolJet authorization bypass flaws were disclosed alongside this CVE on August 31, 2026: CVE-2026-82870 (CVSS 9.6), CVE-2026-82872 (CVSS 9.1), CVE-2026-82875 (CVSS 5.5), CVE-2026-82871 (CVSS 7.7), CVE-2026-82869 (CVSS 7.7), and CVE-2026-82873 (CVSS 5.0). All are patched in v3.16.208; CVE-2026-82869 additionally requires v3.16.44.

See the GitHub Security Advisory for full technical details.

Related coverage
~/articles/2026-08-31-tooljet-seven-auth-bypass-cvss-9-9
supply chain

ToolJet Patches Seven Auth Flaws, Worst CVSS 9.9

ToolJet patches seven authorization bypass flaws, the worst rated CVSS 9.9. Any authenticated Builder can read or modify data across other organizations' ToolJet DB instances.

read →