VULNERABILITY INTELLIGENCE
CVE-2026-82872
CVSS score9.1 CRITICAL
EPSS probability0.51%
CISA KEVNot currently listed
Published2026-08-31
Last modified2026-09-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.
Weakness classification
- disclosure@vulncheck.com: CWE-639