# CVE-2026-82875: ToolJet authorization bypass in TooljetDB controller

Source: https://junglewise.ai/threats/cve-2026-82875-tooljet-authorization-bypass-in-tooljetdb-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82875 · Severity: medium · CVSS 5.5 · Published 2026-08-31

ToolJet is a low-code platform for building internal tools and dashboards. An authenticated user can bypass workspace isolation controls in ToolJet's database module (TooljetDB) by manipulating URL parameters, allowing them to enumerate, create, rename, and delete tables belonging to other organizations on the same instance. This breaks the multi-tenant security boundary and could result in data loss, unauthorized data access, or operational disruption across isolated workspaces.

Technologies: [ToolJet](https://junglewise.ai/threats/technologies/tooljet). Vendors: [ToolJet](https://junglewise.ai/threats/vendors/tooljet).

## Quick answers

**Is CVE-2026-82875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82875 being exploited in the wild.

**How severe is CVE-2026-82875?** Medium severity, with a CVSS score of 5.5, published 31 August 2026.

**Which products and versions are affected?** ToolJet before v3.16.208.

**Is there a fix for CVE-2026-82875?** A patch was published on 2026-08-31: Fixed in v3.16.208 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82875 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-82875?** Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authorization bypass vulnerability (CWE-863) in ToolJet's TooljetDB controller endpoints. The vulnerable code accepts organizationId directly from URL path parameters without validating that the authenticated user's workspace matches the requested organization. While the JwtAuthGuard validates user identity against the tj-workspace-id header, it does not enforce that the organizationId in the URL matches the authenticated user's workspace. The CASL ability factory grants read permissions (VIEW_TABLE, VIEW_TABLES, JOIN_TABLES) to all authenticated users and write permissions (CREATE_TABLE, DROP_TABLE) to any admin/builder regardless of workspace scoping. An authenticated user can exploit this by sending requests with a valid JWT and workspace header from their own workspace, but substituting a different organization ID in the URL to access tables in other workspaces. The attack requires only low privileges (authenticated user with any role) and no user interaction. Patch available in v3.16.208.

## Affected products

- ToolJet ToolJet before v3.16.208

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in v3.16.208

## References

- [https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf](https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf)
- [https://www.vulncheck.com/advisories/tooljet-before-3.16.208-authorization-bypass-via-organizationid](https://www.vulncheck.com/advisories/tooljet-before-3.16.208-authorization-bypass-via-organizationid)

## Related threats

- [ToolJet authorization bypass in app environments init endpoint](https://junglewise.ai/threats/cve-2026-70642-tooljet-before-3-21-94-fixed-in-commit-e5f387a-contains-an)
- [ToolJet missing authentication in onboarding signup endpoint](https://junglewise.ai/threats/cve-2026-126795-a-vulnerability-was-determined-in-tooljet-up-to-3-20-256-lts-3)
- [ToolJet cross-tenant authorization bypass in tooljet-db endpoints](https://junglewise.ai/threats/cve-2026-82874-tooljet-cross-tenant-authorization-bypass-in-tooljet-db-endpoints)
- [ToolJet authorization bypass in resources export endpoint](https://junglewise.ai/threats/cve-2026-82873-tooljet-authorization-bypass-in-resources-export-endpoint)
- [ToolJet authorization bypass in database table operations](https://junglewise.ai/threats/cve-2026-82872-tooljet-authorization-bypass-in-database-table-operations)