Critical severity9.1NVD Advisory· Published Aug 31, 2026

CVE-2026-82872

Description

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.

Affected products

ToolJet/ToolJetllm-fuzzy
Range: <3.16.208

Patches

Vulnerability mechanics

References

github.com/ToolJet/ToolJet/security/advisories/GHSA-2jhv-482p-4phpnvd
www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-workspace-authorization-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000