Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82874ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

Critical 9.9

In plain English

A critical-severity authorization bypass via user-controlled key in ToolJet from ToolJet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 61.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

Affected products (as reported)

Vendor	Product	Versions
ToolJet	ToolJet	0 – before 3.16.208

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-w3hx-rg9g-mw5c) vendor-advisory
VulnCheck Advisory: ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db third-party-advisory