CVE-2026-82872

ToolJet before v3.16.208 does not verify that the organizationId supplied in the request path belongs to the authenticated user's workspace before performing ToolJet DB table operations, an authorization bypass (CWE-639). A workspace administrator triggers the flaw by simply substituting another workspace's organizationId in table-management API requests. The attacker gains the ability to view, create, and delete database tables in other workspaces on the same ToolJet deployment, allowing cross-tenant data exposure and tampering; the CVSS 4.0 score of 7.1 reflects that high (admin) privileges are required and the impact is concentrated on data integrity. Any ToolJet deployment prior to v3.16.208 that hosts multiple workspaces is affected, including self-hosted multi-workspace instances and multi-tenant environments. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3% (17th percentile), indicating no known exploitation.

What to do: Upgrade ToolJet to v3.16.208 or later, which validates that the path organizationId matches the caller's workspace. Until patched, restrict workspace-admin accounts and review ToolJet DB table-management API logs for requests where the organizationId did not match the authenticated user's workspace. Deployments using a single workspace have minimal practical exposure, but multi-workspace instances should prioritize patching.