Cross-Tenant Authorization Bypass in ToolJet by ToolJet

CVE-2026-82874

What is CVE-2026-82874?

ToolJet versions prior to v3.16.208 are susceptible to a cross-tenant authorization bypass. This vulnerability arises from inadequate validation of authenticated users against the organizationId path parameter in the tooljet-db endpoints. As a result, any authenticated Builder user can access, modify, or delete data across different organizations. Attackers may exploit this flaw by retrieving organization IDs from publicly accessible app endpoints and leveraging schema operation endpoints to reveal table schemas, insert malicious tables, corrupt existing data structures, or delete critical data entirely. This vulnerability poses significant risks in environments utilizing multi-tenant architectures.

References