Cross-Workspace Authorization Issue in ToolJet by ToolJet
CVE-2026-82872

7.1HIGH

Key Information:

Vendor

Tooljet

Status
Tooljet
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82872?

ToolJet before version 3.16.208 contains a vulnerability that allows a workspace admin to execute unauthorized database operations on other workspaces. Specifically, this occurs due to improper validation of the organizationId parameter in table-management API requests. As a result, an admin can create, view, and delete database tables outside their intended workspace, posing a significant security risk for affected installations.

Affected Version(s)

ToolJet 0 < 3.16.208

ToolJet 3.16.208

References

https://github.com/ToolJet/ToolJet/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/tooljet-before-3.16....
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

owen050724
.