ToolJet before v3.16.208 Cross-Tenant Database Manipulation

Advisories

ToolJet before v3.16.208 Cross-Tenant Database Manipulation

severity: high
date: 8/31/2026
Affecting: ToolJet >= 0, < 3.16.208
CVE: CVE-2026-82870
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 7.0
CVSS V4 Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
References: GitHub Security Advisory (GHSA-xr3w-r926-xfmm)
Credit: komyunghan
Description: ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo