CVE-2026-82874
Received Received - Intake

ToolJet Authentication Bypass Leading to Data Manipulation

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82874
EUVD
EUVD-2026-68409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tooljet tooljet to 3.16.208 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ToolJet before v3.16.208 has a cross-tenant authorization bypass in the tooljet-db component. Authenticated Builder users can access, modify, or delete tables belonging to other organizations by exploiting insufficient validation of the organizationId path parameter. Attackers can obtain victim organization IDs from public app endpoints and then use schema operation endpoints to disclose schemas, plant malicious tables, corrupt data, or permanently destroy victim data without any relationship to the target organization.

Detection Guidance

To detect this vulnerability, check ToolJet versions before v3.16.208 by inspecting the application version or running commands like 'npm list tooljet' or checking the Docker image tag. Monitor logs for unauthorized access attempts to tooljet-db endpoints with mismatched organization IDs. Verify if users can access tables outside their organization by testing schema operations with different organizationId values.

Impact Analysis

If you are a ToolJet user with Builder privileges, an attacker could access, modify, or delete your organization's data even if they belong to a different organization. This could lead to data leaks, data corruption, or complete data loss. Even if you are not a ToolJet user, your organization's data could be at risk if an attacker exploits this vulnerability against your instance.

Compliance Impact

This vulnerability could lead to unauthorized access, modification, or deletion of sensitive data, violating GDPR's data protection principles and HIPAA's security and privacy requirements. Organizations using affected ToolJet versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches and loss of data integrity.

Mitigation Strategies

Immediately upgrade ToolJet to v3.16.208 or later. Apply the OrganizationValidateGuard to all tooljet-db endpoints accepting organizationId path parameters. Ensure the tj-workspace-id header cannot be spoofed and validate user organization memberships against JWT claims. Restrict Builder role privileges and audit existing tooljet-db access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart