Medium severity5.5NVD Advisory· Published Aug 31, 2026

CVE-2026-82875

Description

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

ToolJet/ToolJetllm-fuzzy
Range: <3.16.208

Patches

Vulnerability mechanics

References

github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvfnvd
www.vulncheck.com/advisories/tooljet-before-3.16.208-authorization-bypass-via-organizationidnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000