ToolJet CVE-2026-82874

Requires (1) a valid authenticated Builder-role account on a ToolJet instance running a version before 3.16.208, and (2) that the instance hosts more than one organization/tenant so a cross-tenant boundary actually exists (a single-tenant deployment has no victim to reach). The attacker must also obtain the target organization's organizationId, which the advisory states is recoverable from public app endpoints, and then invoke the tooljet-db schema-operation endpoints with that foreign ID in the organizationId path parameter. Limiting factors: authentication is mandatory (PR:L - not anonymous), and impact is confined to instances with multiple tenants; single-org self-hosted installs are not meaningfully exposed.

This is a cross-tenant Broken Object Level Authorization / IDOR flaw (CWE-639) in ToolJet's tooljet-db endpoints, where the organizationId path parameter is not validated against the caller's own organization. The vendor CVSS 4.0 base score of 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) is credible: exploitation is remote, low-complexity, needs no user interaction, and yields read/modify/delete of arbitrary tenants' database tables - a genuine full-CIA impact. The one real gate is PR:L: the attacker must hold a valid Builder account somewhere on the instance, so this is an authenticated (not anonymous) attack. Countervailing signals temper urgency: EPSS is low at 0.26% (17th percentile), there is no CISA KEV listing, and the SSVC decision reads Exploitation: none, Automatable: no, Technical Impact: partial - CISA's 'partial' technical impact and 'not automatable' judgment sit in tension with the vendor's 9.4/full-impact scoring. Note the conflict explicitly: the raw CVSS is Critical, but SSVC frames it as not-yet-exploited, non-automatable, and only partially impactful, so this is best treated as a high-priority patch for multi-tenant ToolJet deployments rather than an emergency zero-day. No public exploit is identified at time of analysis and exploitation status is 'none' per SSVC.

An attacker who registers or already holds a Builder account on a shared/multi-tenant ToolJet instance harvests a victim organization's ID from public app endpoints, then issues tooljet-db schema-operation requests using that foreign organizationId in the path. Because the server never checks that the caller belongs to that organization, the attacker enumerates the victim's table schemas and can plant, corrupt, or permanently delete the victim's tables. No public proof-of-concept is identified at time of analysis, but the attack is low-complexity and requires no user interaction beyond holding any Builder-level credential.