ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path… (CVE-2026-82875)

CVE-2026-82875 is an authorization bypass vulnerability affecting ToolJet prior to version 3.16.208. The issue arises because the TooljetDB controller endpoints accept an organizationId parameter from the URL path without verifying that it corresponds to the authenticated user's workspace. As a result, an authenticated user with limited privileges can manipulate this parameter to perform unauthorized actions such as enumerating, creating, renaming, and deleting TooljetDB tables in other users' workspaces. This vulnerability is categorized under CWE-863 (Incorrect Authorization).

The vulnerability allows an authenticated user to bypass authorization controls and perform unauthorized operations on TooljetDB tables across different workspaces. This can lead to unauthorized data access and modification, impacting confidentiality, integrity, and availability of data within ToolJet environments. The CVSS 3.1 base score is 5.5 (medium severity), reflecting local network attack vector with low complexity and no user interaction required.

A fix is available in ToolJet version 3.16.208. Users should upgrade to this version or later to remediate the authorization bypass vulnerability. Since no official patch link is provided, users should consult the ToolJet vendor advisory or official release notes for the update. Until patched, restrict access to authenticated users and monitor for suspicious activity related to organizationId manipulation.