Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-82872

ToolJet before v3.16.208 Cross-Workspace Authorization Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ToolJet ToolJet

Default version status: unaffected

  • 0 to < 3.16.208affected
  • 3.16.208unaffected
pkg:github/ToolJet/ToolJet

References