CVE-2026-82874: ToolJet Authorization Bypass Vulnerability

CVE-2026-82874 Overview

CVE-2026-82874 is a cross-tenant authorization bypass in ToolJet versions before v3.16.208. The application fails to validate that authenticated users belong to the organization referenced in the organizationId path parameter of tooljet-db endpoints. Any authenticated Builder user can read, modify, and delete database tables belonging to other tenants. Attackers can harvest organization IDs from public application endpoints and then invoke schema operations against those tenants. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated Builder users can disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy data belonging to other ToolJet tenants.

Affected Products

ToolJet versions prior to v3.16.208
Self-hosted ToolJet multi-tenant deployments
ToolJet tooljet-db schema operation endpoints

Discovery Timeline

2026-08-31 - CVE-2026-82874 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82874

Vulnerability Analysis

ToolJet is an open-source low-code platform that hosts a built-in database service known as tooljet-db. The service exposes schema operation endpoints scoped by an organizationId path parameter. Affected versions treat this parameter as trusted input and do not check whether the authenticated session belongs to the referenced organization.

Any user with the Builder role in one tenant can issue requests against endpoints of another tenant. Because Builder-level access is common in shared ToolJet deployments, the effective privilege boundary between tenants collapses. Consequences include disclosure of table schemas, injection of attacker-controlled tables, corruption of legitimate schemas, and permanent destruction of victim data.

Root Cause

The root cause is missing tenant scope enforcement on tooljet-db endpoints. The server accepts the organizationId from the URL path and executes the requested schema operation without cross-referencing the caller's organization membership. This is a canonical Insecure Direct Object Reference pattern classified as CWE-639.

Attack Vector

An attacker first authenticates as a Builder in any tenant. The attacker then extracts a victim tenant's organizationId from public app endpoints that leak the identifier. Finally, the attacker calls tooljet-db schema operation endpoints with the harvested organizationId to read, alter, or delete tables in the target tenant. See the VulnCheck advisory and the upstream GitHub Security Advisory GHSA-w3hx-rg9g-mw5c for endpoint specifics.

Detection Methods for CVE-2026-82874

Indicators of Compromise

Requests to tooljet-db endpoints where the organizationId path parameter does not match the caller's session organization.
Unexpected CREATE TABLE, ALTER TABLE, or DROP TABLE events in tenant databases outside of scheduled changes.
Access-log entries showing enumeration of organizationId values across public application endpoints.

Detection Strategies

Correlate application authentication logs with tooljet-db request logs to flag mismatches between session tenant and requested tenant.
Alert on schema mutation operations initiated by Builder users, particularly outside change windows.
Baseline per-tenant table counts and schema hashes; alert on unexplained deviations.

Monitoring Recommendations

Forward ToolJet application and database logs to a central analytics platform with tenant identifiers preserved as first-class fields.
Monitor for spikes in 200-series responses on tooljet-db schema endpoints originating from a single account across multiple organizationId values.
Track deletions of tables and rows in tooljet-db and require secondary approval for destructive operations.

How to Mitigate CVE-2026-82874

Immediate Actions Required

Upgrade all ToolJet instances to v3.16.208 or later.
Audit tooljet-db request history for cross-tenant organizationId usage since the vulnerable version was deployed.
Rotate Builder credentials and review Builder role assignments across tenants.
Restore any tables identified as tampered with from verified backups.

Patch Information

ToolJet resolved the issue in v3.16.208. Details are published in GitHub Security Advisory GHSA-w3hx-rg9g-mw5c. Operators of self-hosted deployments should pull the fixed release and redeploy according to their standard upgrade process.

Workarounds

Restrict network reachability of ToolJet to trusted users while the upgrade is scheduled.
Temporarily downgrade Builder role assignments in shared environments until the patched release is deployed.
Place a reverse proxy in front of tooljet-db endpoints to enforce that the organizationId path segment matches the authenticated session's tenant claim.

bash

# Verify installed ToolJet version and upgrade to the fixed release
docker inspect tooljet --format '{{ .Config.Image }}'
docker pull tooljet/tooljet:v3.16.208
docker compose up -d tooljet