A missing organization-ownership check in ToolJet's database write and destroy routes appears to let any builder-role user create, alter, or drop tables belonging to other tenants, earning a CVSS 3.1 score of 9.6 (Critical).
What Is It
ToolJet before v3.16.208 fails to validate organizationId ownership in its database write and destroy routes. Because the organization-resolving guards are missing, a user holding only builder-role privileges in one organization can reach across tenant boundaries and operate on another organization's database.
The flaw is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key). It was disclosed via VulnCheck, with a corresponding GitHub Security Advisory (GHSA-xr3w-r926-xfmm) published by the ToolJet project.
Why It Matters
The CVSS 3.1 vector associated with the record, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, scored 9.6, describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a changed scope. Integrity and availability impact are both rated High.
Practically, that means an attacker with a legitimate builder account on a shared instance could permanently delete tables, insert arbitrary data, and modify schemas in databases they were never authorized to touch. On multi-tenant deployments, one compromised or malicious builder account may be enough to destroy another customer's data.
A secondary CVSS 4.0 assessment from the same source scores the issue 7.0 (High). That gap does not appear to be a property of the newer model: attack vector and attack complexity are input metrics chosen by whoever performs the scoring, not values the CVSS version derives on its own. The two assessments therefore appear to reflect different judgments about how the flaw is reached, and the 4.0 inputs sit uneasily with the network-reachable, low-complexity characterization above. Defenders should treat the 9.6 CVSS 3.1 rating as the primary metric and assume network reachability with low attack complexity, which matches the described defect; an unguarded API route reachable by any authenticated builder.
What's Vulnerable
- Product: ToolJet (npm package
pkg:npm/tooljet) - Affected: all versions from 0 up to but not including 3.16.208 (semver)
- Fixed: 3.16.208 and later are marked unaffected
No CPE entries were assigned in the record at time of publication.
Patch Status
Upgrade to ToolJet v3.16.208 or later. The vendor advisory identifies 3.16.208 as the first unaffected release. The CVE was published 2026-08-31 and remains in Received status, so enrichment data, including the CVSS metrics above, may still change.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, and no active exploitation has been confirmed in the supplied source material. Exploit maturity is listed as Not Defined.
Sources
- ToolJet GitHub Security Advisory (GHSA-xr3w-r926-xfmm), https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xr3w-r926-xfmm
- VulnCheck Advisory: ToolJet before 3.16.208 cross-tenant database manipulation; https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-database-manipulation
- NVD entry for CVE-2026-82870 (CVSS metrics, version ranges, CPE and record status), https://nvd.nist.gov/vuln/detail/CVE-2026-82870
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog