CVE-2026-82872

Deferred Deferred - Pending Action

ToolJet Path Traversal via Unauthorized DB Table Access

Publication date: 2026-08-31

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-10

Generated

2026-11-08

AI Q&A

2026-08-31

EPSS Evaluated

2026-11-07

NVD

CVE-2026-82872

EUVD

EUVD-2026-68407

Affected Vendors & Products

Vendor	Product	Version / Range
tooljet	tooljet	to 3.16.208 (exc)
tooljet	tooljet	3.20.188-lts
tooljet	tooljet	3.20.189-lts

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

ToolJet before v3.16.208 fails to validate that the organizationId path parameter matches the authenticated user's workspace before performing database table operations. This allows a workspace admin to manipulate the organizationId in API requests to create, view, or delete tables in another workspace without proper authorization.

Detection Guidance

Check ToolJet API logs for requests with mismatched organizationId parameters. Monitor for unauthorized database table operations across different workspaces. Review API request paths for manipulation attempts where organizationId does not match the authenticated user's workspace.

Impact Analysis

An attacker with workspace admin privileges could access, modify, or delete sensitive data in other workspaces. This could lead to data breaches, unauthorized data manipulation, or service disruption across multiple workspaces.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data across workspaces. It undermines access controls and data segregation requirements, potentially leading to compliance violations and legal consequences.

Mitigation Strategies

Upgrade ToolJet to version 3.16.208 or later. Implement strict validation to ensure the organizationId parameter matches the authenticated user's workspace. Add explicit organization validation guards in API endpoints handling table operations.

Hi! I’m here to help you understand CVE-2026-82872. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...