CVE-2026-82870
CRITICAL
NVD
CVSS Score
9.6
Severity
CRITICAL
Published
Aug 31, 2026
Vendor
unknown
Description
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.