ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other… (CVE-2026-82871)

CVE-2026-82871 is a vulnerability in ToolJet prior to version 3.16.208 where the application fails to validate organization membership in database read routes. Authenticated users can exploit this by supplying arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries, thereby reading stored data from other organizations. This represents a broken access control issue (CWE-862) with a CVSS 3.1 score of 7.7 (high severity), indicating network attack vector, low attack complexity, requiring privileges but no user interaction, with high confidentiality impact and no integrity or availability impact.

The vulnerability allows unauthorized disclosure of sensitive data from other organizations within the ToolJet platform. Attackers with valid authentication can access database schemas and actual stored data of victim organizations, potentially leading to significant confidentiality breaches. There is no reported impact on data integrity or availability.

A fix is available in ToolJet version 3.16.208 that addresses the improper validation of organization membership in database read routes. Users should upgrade to version 3.16.208 or later to remediate this vulnerability. No cloud service remediation applies as this is not a cloud-hosted service. Patch status is confirmed by the versioning information in the description.