# CVE-2026-82870: ToolJet authorization bypass in database write routes

Source: https://junglewise.ai/threats/cve-2026-82870-tooljet-authorization-bypass-in-database-write-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82870 · Severity: critical · CVSS 9.6 · Published 2026-08-31

ToolJet is a low-code internal tool builder platform. A vulnerability in its database management API allows any user with builder permissions to create, modify, and delete tables in other organizations' databases on shared instances. An attacker can permanently destroy critical data, inject malicious records, and alter database schemas belonging to competing or unrelated tenants.

Technologies: [ToolJet](https://junglewise.ai/threats/technologies/tooljet). Vendors: [ToolJet](https://junglewise.ai/threats/vendors/tooljet).

## Quick answers

**Is CVE-2026-82870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82870 being exploited in the wild.

**How severe is CVE-2026-82870?** Critical severity, with a CVSS score of 9.6, published 31 August 2026.

**Which products and versions are affected?** ToolJet < 3.16.208.

**Is there a fix for CVE-2026-82870?** A patch was published on 2026-08-31: Fixed in version 3.16.208 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82870 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82870?** Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-639) in the database write and destroy routes under server/src/modules/tooljet-db/controller.ts. Routes for creating, renaming, dropping tables, adding/dropping columns, managing foreign keys, and bulk CSV uploads accept an organizationId path parameter without validating that the caller owns that organization. The JwtAuthGuard only verifies a valid session exists; no guard cross-checks the target organizationId against the caller's JWT-derived organization. Permission checks (userPermission.tjdbCRUD) evaluate only the caller's own permission group, not the target organization. Any builder-role user can exploit this by supplying an arbitrary organizationId in API requests to perform schema and data manipulation on other organizations' databases. The vulnerability is network-reachable, requires authentication (builder role minimum), and affects all shared ToolJet instances. It was patched in version 3.16.208.

## Affected products

- ToolJet ToolJet < 3.16.208

## Timeline

- 2026-08-07: disclosed
- 2026-08-31: advisory
- 2026-08-31: patched: Fixed in version 3.16.208

## References

- [https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xr3w-r926-xfmm](https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xr3w-r926-xfmm)
- [https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-database-manipulation](https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-tenant-database-manipulation)

## Related threats

- [ToolJet authorization bypass in app environments init endpoint](https://junglewise.ai/threats/cve-2026-70642-tooljet-before-3-21-94-fixed-in-commit-e5f387a-contains-an)
- [ToolJet missing authentication in onboarding signup endpoint](https://junglewise.ai/threats/cve-2026-126795-a-vulnerability-was-determined-in-tooljet-up-to-3-20-256-lts-3)
- [ToolJet authorization bypass in TooljetDB controller](https://junglewise.ai/threats/cve-2026-82875-tooljet-authorization-bypass-in-tooljetdb-controller)
- [ToolJet cross-tenant authorization bypass in tooljet-db endpoints](https://junglewise.ai/threats/cve-2026-82874-tooljet-cross-tenant-authorization-bypass-in-tooljet-db-endpoints)
- [ToolJet authorization bypass in resources export endpoint](https://junglewise.ai/threats/cve-2026-82873-tooljet-authorization-bypass-in-resources-export-endpoint)