Is CVE-2026-82869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82869 being exploited in the wild.

How severe is CVE-2026-82869?

High severity, with a CVSS score of 7.7, published 31 August 2026.

Which products and versions are affected?

ToolJet Database before v3.16.44.

Is there a fix for CVE-2026-82869?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82869 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82869?

Check whether you run ToolJet Database at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82869: ToolJet Database privilege escalation in join_tables endpoint

CVE-2026-82869 · Severity: high · CVSS 7.7 · Published 2026-08-31

ToolJet Database is a low-code platform component that allows users to query and manipulate data from connected sources. A privilege escalation flaw in the join_tables endpoint allows any authenticated user—including those with minimal permissions—to read database tables from workspaces they don't belong to, potentially exposing sensitive data across organizations.

Vendors: ToolJet.

Quick answers

Is CVE-2026-82869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82869 being exploited in the wild.
How severe is CVE-2026-82869?: High severity, with a CVSS score of 7.7, published 31 August 2026.
Which products and versions are affected?: ToolJet Database before v3.16.44.
Is there a fix for CVE-2026-82869?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82869 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82869?: Check whether you run ToolJet Database at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the POST /api/tooljet-db/organizations/:organizationId/join endpoint. The root cause involves three combined flaws: (1) the JOIN_TABLES ability is granted unconditionally to all authenticated users without role checks, (2) the OrganizationAuthGuard with isUserNotMandatory=true bypasses strict workspace-membership validation, and (3) the service uses the path :organizationId for data retrieval while authentication is evaluated against the header/token org, decoupling authn/authz from the data source. An attacker with low-privilege credentials (end-user) can craft a request with their own workspace in the tj-workspace-id header and a victim workspace ID in the path, then retrieve arbitrary tables if they know the table UUID. Cross-tenant reads require knowledge of internal-table UUIDs; within-tenant escalation requires only the attacker's own table IDs. Patched in v3.16.44 and later.

Affected products

ToolJet ToolJet Database before v3.16.44

Timeline

2026-08-07: disclosed: GHSA-7vj5-wxfm-gmfq published
2026-08-31: advisory: NVD published CVE-2026-82869

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.