CVE-2026-82870: ToolJet before v3.16.208 Cross-Tenant Database Manipulation
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJetto a version that resolves this vulnerability.Fixed in v3.16.208
Event History
Frequently Asked Questions
Which deployments are affected?
ToolJet versions before 3.16.208 are affected. The cross-tenant impact applies to shared instances where multiple organizations use the service.
What level of access does an attacker need?
An attacker needs a builder-role user account. No user interaction is required, and the vulnerable routes can be reached over the network.
What could indicate that exploitation has already occurred?
Investigate unexpected table creation, schema alterations, inserted data, or dropped tables in an organization's database, particularly where the actions may have originated from a builder-role user belonging to another organization.