CVE-2026-82871CWE-862broken-access-control

CVE-2026-82871

High · published August 31, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-31T13:17Z
References (3)
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xqqj-pfc2-vf48 · [email protected]https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-organization-data-read-via-database-routes · [email protected]https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xqqj-pfc2-vf48 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 08:46Z
    ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
    cvelistv5