ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated… (CVE-2026-82873)

The vulnerability in ToolJet up to version 3.0.0-ee-beta.2 involves authorization bypass in the POST /api/v2/resources/export endpoint. Authenticated users can exploit this by supplying a crafted organization_id parameter to retrieve database schemas from other workspaces or bypass app-level authorization to export restricted app definitions within their own workspace. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 5.0, indicating a moderate severity level. There are no known exploits in the wild and no patch or official remediation information is provided in the data.

The vulnerability allows authenticated users to disclose sensitive database schema information across workspace boundaries and export application definitions that should be restricted. This could lead to unauthorized data exposure within the affected ToolJet environment. However, there is no indication of integrity or availability impact, and exploitation requires valid authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the POST /api/v2/resources/export endpoint to trusted users only and monitor for unusual export activity. Avoid sharing credentials with untrusted parties. Follow vendor updates closely for patches or official mitigations.