Is CVE-2026-82873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82873 being exploited in the wild.

How severe is CVE-2026-82873?

Medium severity, with a CVSS score of 5, published 31 August 2026.

Is there a fix for CVE-2026-82873?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82873 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82873?

Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82873: ToolJet authorization bypass in resources export endpoint

CVE-2026-82873 · Severity: medium · CVSS 5 · Published 2026-08-31

ToolJet is a low-code platform for building internal business applications. The POST /api/v2/resources/export endpoint contains authorization flaws that allow authenticated users to access database schemas and app definitions they should not be able to view. An attacker could disclose table schemas from other workspaces or export restricted app definitions, potentially exposing proprietary application logic and sensitive database structure information.

Technologies: ToolJet. Vendors: ToolJet.

Quick answers

Is CVE-2026-82873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82873 being exploited in the wild.
How severe is CVE-2026-82873?: Medium severity, with a CVSS score of 5, published 31 August 2026.
Which products and versions are affected?: ToolJet <= 3.0.0-ee-beta.2.
Is there a fix for CVE-2026-82873?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82873 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82873?: Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The POST /api/v2/resources/export endpoint suffers from two distinct authorization bypass mechanisms: (1) the service layer trusts a body-supplied organization_id parameter without validating it against the authenticated user's actual workspace memberships, allowing disclosure of TooljetDB table schemas across organization boundaries; (2) the CASL ability factory grants APP_RESOURCE_EXPORT permission without checking per-app authorization constraints (editableAppsId), unlike the sibling APP_RESOURCE_CLONE capability, enabling export of restricted app definitions within a workspace. Both authenticated users and Builder-role users with granular permissions can exploit these flaws via a simple POST request with a crafted body parameter. The vulnerability exists in both EE and CE distributions as of version 3.0.0-ee-beta.2, with the defective code path present in the main branch as of May 2026. No patch has been released as of the advisory publication date.

Affected products

ToolJet ToolJet <= 3.0.0-ee-beta.2

Timeline

2026-08-31: disclosed
2026-08-07: advisory: GitHub security advisory GHSA-pqfh-276q-w3cp published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.