CVE-2026-82875
Received Received - Intake

Authorization Bypass in ToolJet via Unverified OrganizationID

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82875
EUVD
EUVD-2026-68410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tooljet tooljet to 3.16.208 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ToolJet before v3.16.208 has an authorization bypass flaw in TooljetDB controller endpoints. These endpoints accept an organizationId from the URL path without verifying it matches the authenticated user's workspace. This allows authenticated users to manipulate the organizationId to perform unauthorized actions like enumerating, creating, renaming, or deleting TooljetDB tables in any other workspace.

Detection Guidance

To detect this vulnerability, monitor TooljetDB controller endpoints for unauthorized access attempts or requests with manipulated organizationId parameters. Check logs for requests where the organizationId in the URL does not match the tj-workspace-id header. Look for unusual table enumeration, creation, renaming, or deletion activities across different workspaces.

Impact Analysis

An attacker with authenticated access could access, modify, or delete data in other workspaces on the same ToolJet instance. This includes listing tables, creating new ones, renaming existing tables, or deleting tables entirely, which could lead to data loss or unauthorized data exposure.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data isolation between tenants or users, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized cross-workspace data access may lead to data breaches, non-compliance penalties, and loss of trust in the system's security controls.

Mitigation Strategies

Upgrade ToolJet to version v3.16.208 or later to patch the vulnerability. Review and restrict permissions for authenticated users, ensuring write operations are scoped by workspace. Implement strict validation to ensure the organizationId in URL paths matches the authenticated user's workspace. Monitor for unauthorized cross-workspace activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart