CVE-2026-82871

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208

Description An issue exists where organization membership is not validated in database read routes. This allows any authenticated user to access table schemas and row data belonging to other organizations. An attacker can provide arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read stored data from victim organizations.

Recommendations Update ToolJet to version 3.16.208 or later.