CVE-2026-82869

ToolJet Database versions before v3.16.44 do not validate workspace membership or user role on the join_tables endpoint, granting the JOIN_TABLES ability to every authenticated user. An attacker authenticates with their own workspace credentials and then supplies a victim workspace identifier in the request path, an authorization bypass via user-controlled input (CWE-639). This lets the attacker read arbitrary ToolJet Database tables in any workspace on the same ToolJet instance, including data they were never granted access to, with high confidentiality impact to the victim workspace. Any organization running an affected ToolJet deployment is exposed, especially multi-workspace instances shared between teams or customers; the flaw is rated 8.2 (high) on CVSS 4.0 with an adjacent-network attack vector and low privileges required. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Upgrade ToolJet to v3.16.44 or later, which restricts the join_tables endpoint to users with the JOIN_TABLES ability in the target workspace. As an interim measure, limit which authenticated users can reach the ToolJet Database API and verify that ToolJet is only reachable from trusted network segments, since exploitation requires adjacent network access and low-privilege credentials. Administrators of multi-workspace deployments should review whether cross-workspace table reads occurred by checking join_tables request logs for workspace identifiers outside the authenticated user's workspace.