A critical (CVSS 9.9) broken-authorization flaw in ToolJet before v3.16.208 lets any authenticated Builder user read, modify, and destroy database tables belonging to other organizations.
What Is It
ToolJet before v3.16.208 fails to validate that authenticated users actually belong to the organization named in the organizationId path parameter of its tooljet-db endpoints. Because that parameter is trusted as-is, any Builder-level account can act against tenants it has no relationship to; a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) issue.
The most likely attack path is straightforward, though the specific steps below are inferred from the nature of the flaw rather than drawn from a published exploit. An attacker would first need to obtain valid organization IDs for victim tenants, plausibly by harvesting them from app endpoints reachable on the same instance, and then call the schema operation endpoints against those IDs. From there, the advisory's described impact allows disclosure of table schemas, planting of malicious tables, corruption of existing schemas, or permanent destruction of victim data.
Why It Matters
The primary CVSS 3.1 score is 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Attack complexity is low, no user interaction is required, and only low privileges are needed; a single Builder account in any tenant is sufficient. The scope is CHANGED, with high confidentiality, integrity, and availability impact, reflecting that the blast radius extends beyond the attacker's own tenant into every other organization on the instance.
A secondary CVSS 4.0 score of 2.4 (LOW) also appears in the record, though the scoring party and the metrics behind it are not clearly attributed in the available sources, and the figure should be treated as unconfirmed pending NVD analysis. The disparity is worth noting, but the primary 3.1 metric captures the cross-tenant reality: confidentiality loss, silent data poisoning, and permanent destruction of another organization's data are all in play.
There is no CISA KEV entry for this CVE, so active exploitation is not confirmed at this time.
What's Vulnerable
- Product: ToolJet (npm package
pkg:npm/tooljet) - Affected: all versions before 3.16.208
- Unaffected: 3.16.208 and later
- Component:
tooljet-dbendpoints, specifically schema operation endpoints accepting anorganizationIdpath parameter
Patch Status
Upgrade to ToolJet v3.16.208 or later, which is listed as unaffected. The CVE was published 2026-08-31 and its NVD status is still "Received," meaning NVD analysis is not yet complete. No CISA KEV due date or required action applies, since the CVE is not in the KEV catalog. Multi-tenant ToolJet operators should treat this as urgent regardless, given that any low-privileged Builder account on the instance is a viable starting point.
Sources
- NVD, CVE-2026-82874: https://nvd.nist.gov/vuln/detail/CVE-2026-82874
- ToolJet GitHub Security Advisory (GHSA-w3hx-rg9g-mw5c): https://github.com/ToolJet/ToolJet/security/advisories/GHSA-w3hx-rg9g-mw5c
- VulnCheck Advisory: https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-authorization-bypass-via-tooljet-db