CVE-2026-82872 ToolJet CVE debrief

Who should care

Organizations using ToolJet, especially those with multiple workspaces, should be aware of this vulnerability and take steps to mitigate it. This includes applying patches, restricting access to the ToolJet DB table management API, and monitoring for suspicious activity. Security teams and vulnerability management teams should prioritize patching and review compensating controls for exposed systems.

Technical summary

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. This allows a workspace admin to create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests, potentially leading to unauthorized data access or modifications. Organizations using ToolJet should prioritize patching to prevent potential cross-workspace authorization bypasses. The vulnerability could allow attackers to bypass authorization and access or modify data in other workspaces.

Defensive priority

Organizations using ToolJet should prioritize patching to prevent potential cross-workspace authorization bypasses.

Recommended defensive actions

• Apply the patch to update ToolJet to v3.16.208 or later
• Restrict access to the ToolJet DB table management API
• Monitor for suspicious activity in ToolJet workspaces
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description indicates that ToolJet before v3.16.208 fails to validate the path organizationId, allowing a workspace admin to create, view, and delete database tables in another workspace. Official CVE and NVD records provide additional context. The vulnerability allows unauthorized access to database tables across workspaces, potentially leading to data breaches or unauthorized modifications. Defenders should verify affected ToolJet deployments, review official advisories, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.