CVE-2026-82875 in ToolJet
Summary
by MITRE • 08/31/2026
ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The identified security flaw resides within the backend API layer of ToolJet versions prior to 3.16.208, specifically affecting the database controller endpoints that handle organizational data management tasks. The core technical deficiency is a failure to enforce proper authorization checks against the authenticated user's context when processing requests containing an organization identifier in the URL path. Instead of validating whether the provided organizationId corresponds to a workspace owned or managed by the currently authenticated session, the application blindly trusts this parameter as the authoritative source for resource access control. This architectural oversight creates a classic insecure direct object reference scenario where the system fails to verify that the user has explicit permission to interact with the specific organizational entity identified in the request payload.
From an operational perspective, this vulnerability allows any authenticated user to bypass workspace isolation boundaries effectively rendering multi-tenant security controls obsolete for database operations. An attacker can manipulate the organizationId parameter to target resources belonging to other organizations within the same ToolJet instance. This capability enables a range of malicious activities including unauthorized enumeration of existing tables across different workspaces, creation of new database entities in foreign contexts, renaming of critical data structures, and deletion of entire datasets. The impact extends beyond simple data leakage as it compromises the integrity and availability of organizational assets, potentially leading to significant business disruption or loss of sensitive information depending on the nature of the stored data.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure in object-level authorization where access decisions are not properly enforced against user identity. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this flaw facilitates lateral movement within a multi-tenant environment and supports data exfiltration or destruction tactics by allowing unauthorized actors to pivot between isolated organizational units without needing elevated privileges for each target workspace. The lack of server-side validation on the organizationId parameter represents a fundamental break in the principle of least privilege, as users are granted permissions based on manipulated identifiers rather than verified role-based access policies.
To mitigate this risk, immediate patching is required by upgrading ToolJet to version 3.16.208 or later where these authorization checks have been corrected. In environments where patching cannot be implemented instantly, network-level controls such as web application firewalls can be configured to inspect API requests for anomalies in organizationId patterns that deviate from expected user-workspace mappings. Additionally, implementing strict server-side validation logic is critical; developers must ensure that every request involving organizational resources includes a verification step confirming the authenticated session's association with the requested organizationId before processing any database operations. Regular security audits focusing on object-level access controls and continuous monitoring of API logs for unusual cross-tenant activity can further enhance defense-in-depth strategies against this type of authorization bypass.