Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck
CVE-2026-82875ToolJet before v3.16.208 Authorization Bypass via organizationId
Medium 5.5
In plain English
A medium-severity incorrect authorization in ToolJet from ToolJet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 87.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- GitHub Security Advisory (GHSA-cx42-x23w-vhvf) vendor-advisory
- VulnCheck Advisory: ToolJet before v3.16.208 Authorization Bypass via organizationId third-party-advisory