Cve-2026-82871 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-82871/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 11:17:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgToolJet Multi-Tenancy Broken Access Controlhttps://feed.craftedsignal.io/briefs/2026-08-tooljet-id-bypass/Mon, 31 Aug 2026 11:17:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-tooljet-id-bypass/ToolJet versions prior to 3.16.208 are vulnerable to broken access control, allowing authenticated builder-role users to perform unauthorized database operations across tenant boundaries.ToolJet versions before 3.16.208 contain a critical vulnerability in its multi-tenancy implementation related to the validation of organization ownership. The application fails to properly verify the 'organizationId' during database write and destroy operations. This oversight allows a user assigned the 'builder' role within one organization to interact with, modify, or destroy database tables belonging to different organizations hosted on the same instance. This vulnerability poses a severe risk to data integrity and availability in shared multi-tenant deployments, as it permits unauthorized schema manipulation, arbitrary data insertion, and permanent deletion of tenant data across organization boundaries. Defenders should prioritize patching instances to version 3.16.208 or later to enforce tenant isolation.

Impact

Successful exploitation allows for cross-tenant data exfiltration, unauthorized modification of sensitive business data, and permanent loss of database tables. This vulnerability is particularly impactful for organizations hosting multiple internal teams or clients on a single shared ToolJet instance, as it undermines the fundamental multi-tenancy security model.

Recommendation

  • Upgrade all ToolJet deployments to version 3.16.208 or later immediately to patch CVE-2026-82870.
  • Review application access logs for any database-related API requests involving IDs belonging to organizations outside of the user's assigned scope.
  • Audit the list of users currently assigned the 'builder' role and restrict access to strictly verified users until the patch is applied.
]]>criticaladvisorywebserverbroken-access-controlvulnerabilityweb-application-vulnerabilityauthorization-bypassprivilege-escalationweb-applicationauthentication-bypasscve-2026-82871