🚨 CRITICAL SaaS SECURITY — MULTIPLE TOOLJET FLAWS DISCLOSED TODAY CAN BREAK THE BOUNDARY BETWEEN CUSTOMER WORKSPACES The worst, CVE-2026-82872, scores 9.1 and can let one workspace admin manipulate DATABASE TABLES belonging to another organization. Thread ↓ 1/ Several new ToolJet vulnerabilities entered public CVE feeds today. Most important: CVE-2026-82872 CVSS: **9.1 CRITICAL** Affected: ToolJet before **3.16.208**. 2/ The issue is an authorization failure around: `organizationId`. ToolJet did not correctly verify that the organization ID supplied in the request path actually belonged to: the authenticated user's workspace. 3/ Attack model: Attacker has valid ToolJet account ↓ controls/administers Workspace A ↓ captures database API request ↓ replaces organizationId ↓ points request at Workspace B ↓ authorization boundary fails ↓ victim database resources become reachable. 4/ CVE-2026-82872 can allow cross-workspace operations including: CREATE table VIEW table DELETE table. That's why the confidentiality, integrity and availability impact is severe. 5/ But it isn't alone. CVE-2026-82871 allows authenticated users to access table schemas and stored row data belonging to OTHER organizations. Affected: ToolJet < 3.16.208. 6/ Another issue: CVE-2026-82869 affects ToolJet Database before: **3.16.44** and allows low-privileged authenticated users to abuse the `join_tables` functionality to read arbitrary tables across workspace boundaries. 7/ This is a classic multi-tenant security failure. SaaS architecture: Customer A ↓ same platform ↓ Customer B. The most important boundary isn't always: internet → application. Sometimes it's: **Tenant A → Tenant B.** 8/ Why this matters: Multi-tenant SaaS depends on a promise: your authenticated user may access YOUR resources. Not: whatever organization ID appears in the URL. Authorization therefore must validate: identity + tenant membership + resource ownership on EVERY request. 9/ Defender action: ToolJet administrators should verify their exact versions. For the newer cross-organization issues: upgrade to **3.16.208 or later**. Review logs for: unexpected organization IDs cross-workspace database access table enumeration abnormal join queries. 10/ Important caveat: These flaws require authenticated access. This is NOT: anonymous internet attacker → instant database compromise. Privilege requirements differ across the individual CVEs. But once an attacker has a valid account, tenant boundaries may become the target. 11/ CyberSignal insight: In SaaS security, authentication proves you belong somewhere. Authorization must prove that EVERY object you're touching belongs there too. Sources: VulnCheck · MITRE/NVD · ToolJet security advisories
Post summary
The text announces multiple critical ToolJet vulnerabilities (CVE‑2026‑82869, ‑82871, ‑82872), explains an authorization failure allowing cross‑workspace database actions, and recommends upgrading to 3.16.208 or later to mitigate the risk.