critical9.1
CVE-2026-82872
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operation…
Impact
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.
Affected products
| Product | Affected versions |
|---|---|
| ToolJet | before 3.16.208 |
Versions were read from the advisory text. No structured product data has been published for this record yet.