Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82874

ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

CVSS 4.0 9.4 CRITICALCVSS 3.1 9.9 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82874

Published

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82874

Published

ToolJet

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ToolJet",
                    "product": "ToolJet",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:github/ToolJet/ToolJet",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "3.16.208"
                        },
                        {
                            "version": "3.16.208",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON