high7.7
CVE-2026-82869
ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authe…
Impact
ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.
Affected products
| Product | Affected versions |
|---|---|
| ToolJet Database | before 3.16.44 |
Versions were read from the advisory text. No structured product data has been published for this record yet.