Auth bypass in Tooljet
CVE-2026-82871
ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.
Vulnerability class: Broken Access Control
EPSS: 0.002 (12.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82871?
- CVE-2026-82871 is a high-severity vulnerability in Tooljet, classified under Missing Authorization. CVSS score: 7.7/10. Published 2026-08-31.
- How severe is CVE-2026-82871?
- High severity. CVSS v3 base score is 7.7 out of 10.