CVE-2026-82871: ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ToolJet user can exploit it. The attacker needs only a valid account and the ability to supply another organization's ID in affected database-read URL parameters.
What information could be exposed?
An attacker can list tables, retrieve column definitions, and run join queries against another organization's database routes. This can expose table schemas and stored row data from victim organizations.
Are unauthenticated ToolJet instances affected?
The described attack requires authentication, so an unauthenticated attacker cannot exploit it directly. However, any valid user account may be sufficient; no elevated privileges are stated as required.
What versions should be remediated?
ToolJet versions before 3.16.208 are affected. Upgrade to version 3.16.208 or later.