CVE-2026-82871

ToolJet versions before 3.16.208 contain a missing-authorization flaw (CWE-862) in the routes serving its internal database: the application does not verify that the requesting user is a member of the organization whose data is requested. An attacker only needs any valid authenticated account and can then supply arbitrary organization IDs in URL parameters to list another organization's tables, retrieve column definitions, and run join queries that return actual stored row data. This yields a cross-tenant confidentiality breach (CVSS 4.0 8.2, high confidentiality impact) with no integrity or availability impact. All deployments on affected versions are exposed, with the greatest risk to multi-organization instances, including self-hosted multi-workspace setups and cloud/SaaS environments, where one tenant's accounts can read another tenant's data. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates a 0.2% probability of exploitation within 30 days, so no exploitation is currently confirmed.

What to do: Upgrade ToolJet to v3.16.208 or later. If you cannot upgrade immediately, treat cross-organization data as potentially read: review database access logs for requests carrying organization IDs other than the caller's own, and audit user accounts across workspaces. Self-hosted single-organization instances see little practical impact but should still patch.