Unauthorized Data Access in ToolJet by ToolJet Technologies

CVE-2026-82871

What is CVE-2026-82871?

ToolJet versions prior to 3.16.208 contain a vulnerability that permits authenticated users to access sensitive data belonging to other organizations. The flaw arises from insufficient validation of organization memberships within database read routes, causing a potential exposure of database table schemas and specific row data. By manipulating URL parameters to introduce arbitrary organization IDs, an attacker can enumerate tables, retrieve column definitions, and perform queries that leak actual data from impacted organizations. This underscores the importance of stringent access controls and proper data validation in multi-tenant environments.

References