CVE-2026-82873

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.0.0-ee-beta.2

Description An authorization bypass exists in the 'POST /api/v2/resources/export' endpoint. Authenticated users can disclose TooljetDB table schemas across workspace boundaries or export app definitions by bypassing granular permission gates. This is achieved by providing a specific organization id parameter in the request body to access schemas from other workspaces or to export restricted app definitions within their own workspace.

Recommendations Update ToolJet to a version later than 3.0.0-ee-beta.2. As a temporary mitigation, restrict access to the 'POST /api/v2/resources/export' endpoint.