CVE-2026-82870

ToolJet before v3.16.208 contains an authorization bypass (CWE-639) in its internal database write and destroy routes, which do not validate that the organizationId in a request belongs to the requesting user. A builder-role user on a shared multi-tenant instance can therefore issue table creation, schema alteration, data insertion, and table destruction operations against other organizations' ToolJet Databases, including permanent deletion of tables. The flaw is triggered by sending database API requests with an attacker-chosen organizationId; there is no guard resolving the organization from the authenticated user's context. Anyone running an affected ToolJet version on an instance shared by multiple organizations is at risk, with impact including cross-tenant data loss, data pollution, and schema changes; single-tenant self-hosted deployments are largely unaffected. Exploitation has not been reported: there is no public proof-of-concept, it is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days, though the CVSS 4.0 score of 7 (high) reflects the potential severity of permanent cross-tenant table deletion.

What to do: Upgrade ToolJet to v3.16.208 or later, which restores organizationId ownership validation on database write and destroy routes. Until patched, restrict builder-role accounts on shared instances to trusted users and audit ToolJet Databases for unexpected dropped tables, inserted data, or schema changes. Single-tenant deployments are minimally affected, but any instance hosting multiple organizations should be treated as exposed.