ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create,… (CVE-2026-82870)

CVE-2026-82870 is a high-severity vulnerability in ToolJet before version 3.16.208. The application does not properly validate organizationId ownership in database write and destroy API routes. As a result, users with builder-role permissions can perform unauthorized actions such as creating, altering, or dropping tables in databases of other organizations sharing the same instance. This cross-tenant access flaw allows attackers to permanently delete tables, insert arbitrary data, and modify database schemas beyond their authorized scope, violating tenant isolation.

The vulnerability enables unauthorized users with builder-role access to manipulate database schemas and data across organizational boundaries. This can lead to permanent deletion of tables, unauthorized data insertion, and schema modifications in other tenants' databases on shared ToolJet instances. The impact includes loss of data integrity and availability, and potential disruption of multiple organizations' applications relying on the affected databases.

A fix is available in ToolJet version 3.16.208 and later. Users should upgrade to v3.16.208 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds. Until patched, restrict builder-role user privileges and avoid shared instances if possible.