CVE-2026-82869Disclosure

🚨 CRITICAL SaaS SECURITY — MULTIPLE TOOLJET FLAWS DISCLOSED TODAY CAN BREAK THE BOUNDARY BETWEEN CUSTOMER WORKSPACES The worst, CVE-2026-82872, scores 9.1 and can let one workspace admin manipulate DATABASE TABLES belonging to another organization. Thread ↓ 1/ Several new ToolJet vulnerabilities entered public CVE feeds today. Most important: CVE-2026-82872 CVSS: **9.1 CRITICAL** Affected: ToolJet before **3.16.208**. 2/ The issue is an authorization failure around: `organizationId`. ToolJet did not correctly verify that the organization ID supplied in the request path actually belonged to: the authenticated user's workspace. 3/ Attack model: Attacker has valid ToolJet account ↓ controls/administers Workspace A ↓ captures database API request ↓ replaces organizationId ↓ points request at Workspace B ↓ authorization boundary fails ↓ victim database resources become reachable. 4/ CVE-2026-82872 can allow cross-workspace operations including: CREATE table VIEW table DELETE table. That's why the confidentiality, integrity and availability impact is severe. 5/ But it isn't alone. CVE-2026-82871 allows authenticated users to access table schemas and stored row data belonging to OTHER organizations. Affected: ToolJet < 3.16.208. 6/ Another issue: CVE-2026-82869 affects ToolJet Database before: **3.16.44** and allows low-privileged authenticated users to abuse the `join_tables` functionality to read arbitrary tables across workspace boundaries. 7/ This is a classic multi-tenant security failure. SaaS architecture: Customer A ↓ same platform ↓ Customer B. The most important boundary isn't always: internet → application. Sometimes it's: **Tenant A → Tenant B.** 8/ Why this matters: Multi-tenant SaaS depends on a promise: your authenticated user may access YOUR resources. Not: whatever organization ID appears in the URL. Authorization therefore must validate: identity + tenant membership + resource ownership on EVERY request. 9/ Defender action: ToolJet administrators should verify their exact versions. For the newer cross-organization issues: upgrade to **3.16.208 or later**. Review logs for: unexpected organization IDs cross-workspace database access table enumeration abnormal join queries. 10/ Important caveat: These flaws require authenticated access. This is NOT: anonymous internet attacker → instant database compromise. Privilege requirements differ across the individual CVEs. But once an attacker has a valid account, tenant boundaries may become the target. 11/ CyberSignal insight: In SaaS security, authentication proves you belong somewhere. Authorization must prove that EVERY object you're touching belongs there too. Sources: VulnCheck · MITRE/NVD · ToolJet security advisories