Cross-Tenant Database Manipulation in ToolJet by ToolJet

CVE-2026-82870

What is CVE-2026-82870?

ToolJet versions prior to v3.16.208 expose serious security weaknesses due to inadequate validation of organizationId ownership within their database interaction routes. This flaw enables users with builder roles to manipulate databases across organizational boundaries. Malicious actors can exploit this oversight to delete critical tables, insert unauthorized data, and alter database schemas. The absence of organization-resolving guards raises significant risks in shared environments, potentially leading to data breaches and loss of data integrity across multiple tenants.

References