Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: ToolJet 3.16.208 Clear all filters
TI-2026-57179 CVE-2026-82875 · GHSA-vhf9-px93-5p48

ToolJet before v3.16.208 Authorization Bypass via organizationId

Priority MEDIUM 56

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace.

CVSS 4.0MEDIUM 5.1 Adjacent network Low privileges No interaction EPSS 0.00219 Published 2026-08-31 Fixed in 3.16.208 CWE-863
TI-2026-57178 CVE-2026-82874 · GHSA-7xg3-7665-2f35

ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

Priority MEDIUM 41

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00442 Published 2026-08-31 Fixed in 3.16.208 CWE-639
TI-2026-57176 CVE-2026-82872 · GHSA-65xf-8w4c-54h2

ToolJet before v3.16.208 Cross-Workspace Authorization Bypass

Priority HIGH 66

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations.

CVSS 4.0HIGH 7.1 Adjacent network High privileges No interaction EPSS 0.00511 Published 2026-08-31 Fixed in 3.16.208 CWE-639
TI-2026-57175 CVE-2026-82871 · GHSA-6cq6-3jwx-45wq

ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

Priority HIGH 69

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data.

CVSS 4.0HIGH 8.2 Adjacent network Low privileges No interaction EPSS 0.00407 Published 2026-08-31 Fixed in 3.16.208 CWE-862
TI-2026-57174 CVE-2026-82870 · GHSA-9fvx-4ww2-hqm9

ToolJet before v3.16.208 Cross-Tenant Database Manipulation

Priority MEDIUM 64

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases.

CVSS 4.0HIGH 7.0 Adjacent network Low privileges No interaction EPSS 0.00431 Published 2026-08-31 Fixed in 3.16.208 CWE-639