Critical severity · published Aug 31, 2026
CVE-2026-82870
ToolJet before v3.16.208 Cross-Tenant Database Manipulation
9.6
CVSS
0.4%
EPSS
No
On KEV
Description
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
ToolJet · ToolJet
before 3.16.208 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82870
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82870
github.com
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xr3w-r926-xfmm
www.vulncheck.com
https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-database-manipulation
More from ToolJet
9.9
CVE-2026-82874
ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
9.4
CVE-2026-55413
ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution
9.1
CVE-2026-82872
ToolJet before v3.16.208 Cross-Workspace Authorization Bypass
8.8
CVE-2026-54344
ToolJet GitHub Actions comment body shell injection exposes deployment secrets
8.8
CVE-2022-3019
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an…