critical9.6
CVE-2026-82870
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or d…
Impact
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
Affected products
| Product | Affected versions |
|---|---|
| ToolJet | before 3.16.208 |
Versions were read from the advisory text. No structured product data has been published for this record yet.