ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of… (CVE-2026-82874)

The vulnerability in ToolJet prior to version 3.16.208 is due to improper authorization checks on the organizationId path parameter in tooljet-db endpoints. Authenticated users with Builder privileges can exploit this flaw to perform unauthorized schema operations on databases of other organizations. Attackers can obtain victim organization IDs from public app endpoints and then use schema operation endpoints to disclose table schemas, create malicious tables, corrupt schemas, or delete data belonging to other tenants. This represents a critical authorization bypass affecting multi-tenant data isolation.

Successful exploitation allows an authenticated Builder user to bypass tenant isolation controls, resulting in full read, write, and delete access to database tables across organization boundaries. This can lead to severe confidentiality, integrity, and availability impacts including data disclosure, data corruption, and permanent data loss for victim organizations.

A fix is available in ToolJet version 3.16.208 and later. Users should upgrade to v3.16.208 or newer to remediate this vulnerability. No other mitigations are documented. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is included in v3.16.208.