CVE-2026-82869 in ToolJet
Summary
by MITRE • 08/31/2026
ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The identified security flaw resides within the join_tables endpoint of ToolJet Database versions prior to v3.16.44, representing a critical failure in access control logic that allows for unauthorized privilege escalation. This vulnerability stems from an insufficient validation mechanism where the system fails to verify whether the authenticated user possesses the necessary permissions or workspace membership associated with the target resource. Specifically, the endpoint grants JOIN_TABLES capabilities to all authenticated users regardless of their actual role or affiliation within a specific workspace environment. By omitting checks that ensure the requesting entity is authorized to interact with data in the specified context, the application exposes sensitive information to any user who can successfully authenticate against the platform.
From an operational perspective, this flaw enables attackers to read arbitrary tables from ToolJet Database instances belonging to other workspaces. The exploitation vector involves supplying victim workspace identifiers directly within the request path while authenticating using credentials associated with a different, potentially less privileged or unrelated workspace. This technique effectively bypasses multi-tenant isolation boundaries, allowing an attacker to traverse across organizational silos and extract data that should remain strictly confined to its originating workspace. Such unauthorized access compromises the confidentiality of proprietary business logic, customer data, and internal configurations stored within these databases, leading to significant potential for intellectual property theft or further lateral movement within a compromised environment.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining privileges that they are not authorized to have due to flawed access control checks. Furthermore, the exploitation technique corresponds to MITRE ATT&CK tactic T1078, specifically Valid Accounts and potentially T1530 if data exfiltration is confirmed, highlighting how legitimate credentials can be misused to bypass security controls when underlying application logic does not enforce strict resource ownership verification. The lack of workspace membership validation represents a fundamental architectural oversight in multi-tenant SaaS applications where tenant isolation is paramount for maintaining data integrity and privacy guarantees.
To mitigate this risk, organizations must immediately upgrade ToolJet Database to version v3.16.44 or later, which addresses the underlying logic errors in the join_tables endpoint. In addition to applying vendor patches, security teams should implement strict input validation on all workspace identifiers provided in API requests, ensuring that these values are cross-referenced against the authenticated user's authorized resource list before processing any database queries. Implementing robust role-based access control checks at the application layer is essential to prevent privilege escalation attacks. Regular penetration testing focused on horizontal and vertical privilege escalation scenarios can help identify similar flaws in other endpoints where tenant isolation might be similarly compromised, ensuring that multi-tenant architectures maintain their intended security boundaries against malicious actors seeking to exploit trust relationships within the system.