CVE-2026-82869: ToolJet Database before v3.16.44 Privilege Escalation via join_tables
ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJet Databaseto a version that resolves this vulnerability.Fixed in 3.16.44 - Compensating control
Restrict access to the ToolJet Database join_tables endpoint so only authorized users/clients can reach it; this mitigates arbitrary table reads and privilege escalation while upgrading to v3.16.44.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment running a ToolJet Database version earlier than v3.16.44 is affected. The vulnerable endpoint grants access without validating the caller's role or membership in the targeted workspace.
What does an attacker need to exploit it?
An attacker needs to be authenticated with credentials for any ToolJet workspace. They can then provide identifiers for a victim workspace in the request path to access its database tables.
What is the potential impact?
An authenticated low-privilege user can obtain JOIN_TABLES capability and read arbitrary ToolJet Database tables belonging to other workspaces. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
How can I determine whether my deployment is affected?
Check whether the ToolJet Database version is earlier than v3.16.44. Also review access to the join_tables endpoint for requests authenticated by one workspace that reference identifiers belonging to another workspace.