PT-2026-83747
CVE-2026-82870
·
Published
2026-08-31
·
Updated
2026-09-17
Description by
CVSS 3.1
9.6
CriticalMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ToolJet versions prior to 3.16.208
Description
Insufficient validation of
organizationId ownership in database write and destroy routes allows users with the builder role to perform unauthorized actions on databases belonging to other organizations. Due to missing organization-resolving guards, an attacker can create, modify, or permanently delete tables and schemas across tenant boundaries on shared instances.Recommendations
Update ToolJet to version 3.16.208 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾