CVE-2026-82875: ToolJet before v3.16.208 Authorization Bypass via organizationId
ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ToolJet user with low privileges can exploit it. The user must be able to send requests to the affected TooljetDB controller endpoints and modify the organizationId value in the URL path.
What access does exploitation provide?
An attacker can access TooljetDB tables belonging to other workspaces, including enumerating, creating, renaming, and deleting tables. This can affect the confidentiality, integrity, and availability of cross-workspace data.
Are unauthenticated or default deployments affected?
The issue requires authentication, so unauthenticated attackers cannot exploit it based on the available information. Whether a particular default deployment exposes the affected endpoints is not stated.
What version should be used to remediate the issue?
Upgrade ToolJet to version 3.16.208 or later. Versions before 3.16.208 are affected.