Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82869ToolJet Database before v3.16.44 Privilege Escalation via join_tables

High 7.7

In plain English

A high-severity authorization bypass via user-controlled key in ToolJet from ToolJet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.

Affected products (as reported)

Vendor	Product	Versions
ToolJet	ToolJet	0 – before 3.16.44

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-7vj5-wxfm-gmfq) vendor-advisory
VulnCheck Advisory: ToolJet Database before v3.16.44 Privilege Escalation via join_tables third-party-advisory