ToolJet CVE-2026-82871

Exploitation requires a valid authenticated ToolJet session; any low-privilege user account within the shared instance is sufficient (PR:L per CVSS). The ToolJet deployment must be operating in multi-tenant mode with multiple organizations sharing a single instance - single-tenant deployments have no cross-organization data to expose. The attacker must have network access to the ToolJet application's HTTP API. No elevated roles, admin permissions, or non-default feature enablement are required beyond basic login. Exploitation is constrained to read-only operations - no data modification or deletion is possible through the vulnerable routes. The attacker must enumerate or guess valid organization IDs, which may be sequential integers or UUIDs; predictability of these identifiers affects practical exploitation speed but not feasibility.

The CVSS 4.0 score of 8.2 reflects high confidentiality impact against both the vulnerable system and subsequent (cross-tenant) systems, with low complexity and low privilege requirements - the dominant risk is complete cross-tenant data theft. The provided CVSS 4.0 vector uses AV:A (adjacent network), which may reflect the typical internal deployment posture of ToolJet, though the actual attack surface is purely application-layer HTTP and accessible to any authenticated user with web access to the instance; AV:N may be more representative for internet-exposed deployments. No KEV listing and no public exploit code has been identified, limiting immediate mass-exploitation risk. Exploitation mechanics are however extremely simple - arbitrary org ID substitution in URL parameters requires no special tooling. EPSS data is not available in the provided intelligence. The absence of integrity and availability impact constrains the vector to data exfiltration, but for shared multi-tenant deployments, cross-tenant confidentiality breach carries severe business and compliance consequences.

An authenticated ToolJet user in Organization A probes the database read API endpoints and discovers that organization IDs in URL parameters are not validated against their session. By iterating through numeric or UUID organization identifiers, they enumerate Organization B's table schemas and retrieve complete row data via join queries - all using standard HTTP requests with modified parameters and no custom tooling required.