A missing ownership check in ToolJet before v3.16.208 allows a workspace admin to create, view, and delete database tables belonging to any other workspace by tampering with a single API parameter.
What Is It
CVE-2026-82872 is an insecure direct object reference (CWE-639) in ToolJet's DB table-management API. The application fails to validate that the organizationId supplied in the request path matches the workspace of the authenticated user before carrying out ToolJet DB table operations.
The result is a straightforward horizontal privilege escalation: an authenticated workspace admin substitutes another workspace's organizationId in table-management API requests and the backend honors it, granting create, read, and delete access to tables the user has no legitimate claim to.
The flaw was disclosed by VulnCheck, which assigns it a CVSS 3.1 base score of 9.1 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The scope-changed rating reflects that the impact crosses a tenant boundary. A secondary CVSS 4.0 score of 7.1 (HIGH) is also published for the same issue.
Why It Matters
ToolJet is a multi-tenant low-code platform, and workspace separation is the security boundary customers rely on. This bug erases that boundary for anyone who already holds admin rights in any single workspace; a bar that is low in shared or SaaS-style deployments where admin roles are handed out freely.
Because the attack covers deletion as well as read and write, the exposure is not limited to data theft. An attacker can destroy tables in a victim workspace, which is why confidentiality, integrity, and availability are all rated HIGH.
No CISA KEV entry accompanies this CVE, so there is no confirmation of active exploitation at this time, and no federally mandated remediation deadline applies.
What's Vulnerable
- Vendor/Product: ToolJet (npm package
pkg:npm/tooljet) - Affected versions: all versions before 3.16.208
- Fixed version: 3.16.208 and later (marked unaffected)
- Prerequisite: authenticated access with workspace admin privileges
Patch Status
Patched in ToolJet v3.16.208. Operators running any earlier release should upgrade. Where immediate patching is not possible, review who currently holds workspace admin roles and audit table-management API activity for requests carrying an organizationId that does not belong to the caller.