ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability… (CVE-2026-82869)

CVE-2026-82869 describes a privilege escalation vulnerability in ToolJet Database versions prior to v3.16.44. The vulnerability exists in the join_tables endpoint, which improperly grants JOIN_TABLES ability to all authenticated users without verifying their roles or workspace memberships. This allows attackers to access and read arbitrary tables across different workspaces by supplying victim workspace identifiers in requests, despite authenticating with their own workspace credentials. The CVSS 3.1 score is 7.7, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. The impact is primarily confidentiality loss, with no integrity or availability impact reported.

An attacker with valid authentication can escalate privileges to gain JOIN_TABLES ability, enabling unauthorized reading of arbitrary database tables from any workspace. This results in a significant confidentiality breach across workspaces within the ToolJet Database environment. There is no reported impact on data integrity or availability.

A fix is available in ToolJet Database version 3.16.44. Users should upgrade to version 3.16.44 or later to remediate this vulnerability. Since the service is not cloud-hosted, manual patching is required. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.