CVE-2026-82872
Received Received - Intake

ToolJet Path Traversal via Unauthorized DB Table Access

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82872
EUVD
EUVD-2026-68407

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tooljet tooljet to 3.16.208 (exc)
tooljet tooljet 3.20.188-lts
tooljet tooljet 3.20.189-lts

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ToolJet before v3.16.208 fails to validate that the organizationId path parameter matches the authenticated user's workspace before performing database table operations. This allows a workspace admin to manipulate the organizationId in API requests to create, view, or delete tables in another workspace without proper authorization.

Detection Guidance

Check ToolJet API logs for requests with mismatched organizationId parameters. Monitor for unauthorized database table operations across different workspaces. Review API request paths for manipulation attempts where organizationId does not match the authenticated user's workspace.

Impact Analysis

An attacker with workspace admin privileges could access, modify, or delete sensitive data in other workspaces. This could lead to data breaches, unauthorized data manipulation, or service disruption across multiple workspaces.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data across workspaces. It undermines access controls and data segregation requirements, potentially leading to compliance violations and legal consequences.

Mitigation Strategies

Upgrade ToolJet to version 3.16.208 or later. Implement strict validation to ensure the organizationId parameter matches the authenticated user's workspace. Add explicit organization validation guards in API endpoints handling table operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart