Skip to main content

ToolJet EUVDEUVD-2026-68410

| CVE-2026-82875 MEDIUM
Incorrect Authorization (CWE-863)
2026-08-31 VulnCheck GHSA-vhf9-px93-5p48
Authentication Bypass Tooljet
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Adjacent vector and low privileges per CVSS 4.0 input; no scope change as impact is confined to TooljetDB table operations within the application.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM 5.1
Patch available
Aug 31, 2026 - 10:16 EUVD
Analysis Generated
Aug 31, 2026 - 09:31 vuln.today

DescriptionCVE.org

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

AnalysisAI

Authorization bypass in ToolJet before v3.16.208 permits any authenticated user to enumerate, create, rename, and delete TooljetDB tables belonging to arbitrary workspaces by supplying a foreign organizationId in the URL path of affected API endpoints. The TooljetDB controller accepts organizationId from the request path without validating it against the requesting user's actual workspace context, completely breaking tenant isolation in multi-workspace deployments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated ToolJet session with at minimum low-privilege access (any user account suffices; no admin role is needed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L yields a score of 5.1 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade ToolJet to v3.16.208 or later, which resolves the flaw by enforcing server-side validation that the organizationId in each TooljetDB request matches the authenticated user's assigned workspace. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tooljet

View all
CVE-2022-3019 HIGH POC
8.8 Aug 29

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that w
CVE-2022-2631 HIGH POC
8.8 Aug 02

Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. Rated high severity (CVSS 8.8), this vuln
CVE-2022-23067 HIGH POC
8.8 May 18

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . Ra
CVE-2022-2037 HIGH POC
8.0 Jun 09

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. Rated high severity (CVSS 8.0), this vul
CVE-2022-27978 HIGH POC
7.5 Apr 26

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a
CVE-2022-3422 HIGH POC
7.5 Oct 07

Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Rated high severity (CVSS
CVE-2022-4111 MEDIUM POC
6.5 Nov 22

Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile
CVE-2022-27979 MEDIUM POC
5.4 Apr 26

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML v
CVE-2026-55413 CRITICAL
9.4 Jun 25

Stored code injection in ToolJet self-hosted (prior to 3.20.178-lts) lets any authenticated builder-role user - availabl
CVE-2022-23068 MEDIUM POC
5.4 May 18

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside t
CVE-2022-3348 MEDIUM POC
4.9 Sep 28

Just like in the previous report, an attacker could steal the account of different users. Rated medium severity (CVSS 4.
CVE-2026-54344 HIGH
8.8 Jul 08

CI/CD pipeline injection in ToolJet's GitHub Actions render-preview deployment workflow (versions prior to 3.20.180) all

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-68410 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy