CRITICAL
9.9 CVE-2026-82874 Published 31 Aug 2026
ToolJet Cross-Tenant Data Access Vulnerability
Worried this affects one of your servers?
ToolJet before v3.16.208 fails to validate user organization.
Builder users can access and manipulate data across tenant boundaries.
- Attackers can extract organization IDs from public app endpoints.
- Vulnerable endpoints: tooljet-db schema operation endpoints.
Reference: CVE-2026-82874 on NVD
← Back to Security News