Is there a patch available for CVE-2026-82875?

Yes, a patch is available for CVE-2026-82875. Update the affected software to the latest version immediately.

ToolJet CVE-2026-82875

Q: What is the CVSS score of CVE-2026-82875?

CVE-2026-82875 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-68410 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-31 VulnCheck

GHSA-vhf9-px93-5p48

Authentication Bypass Tooljet

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Adjacent vector and low privileges per CVSS 4.0 input; no scope change as impact is confined to TooljetDB table operations within the application.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Aug 31, 2026 - 10:50 cve.org

MEDIUM 5.1

Patch available

Aug 31, 2026 - 10:16 EUVD

Analysis Generated

Aug 31, 2026 - 09:31 vuln.today

DescriptionCVE.org

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

AnalysisAI

Authorization bypass in ToolJet before v3.16.208 permits any authenticated user to enumerate, create, rename, and delete TooljetDB tables belonging to arbitrary workspaces by supplying a foreign organizationId in the URL path of affected API endpoints. The TooljetDB controller accepts organizationId from the request path without validating it against the requesting user's actual workspace context, completely breaking tenant isolation in multi-workspace deployments. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated ToolJet session with at minimum low-privilege access (any user account suffices; no admin role is needed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L yields a score of 5.1 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade ToolJet to v3.16.208 or later, which resolves the flaw by enforcing server-side validation that the organizationId in each TooljetDB request matches the authenticated user's assigned workspace. … Detailed patch versions, workarounds, and compensating controls in full report.