CVE-2026-82869

8.2 highEPSS 0.4%

High (8.2). EPSS 0.4% chance of exploitation in the next 30 days.

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.

Severity

CVSS 4.0

8.2 high

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

7.7 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-08-31
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://github.com/ToolJet/ToolJet/security/advisories/GHSA-7vj5-wxfm-gmfq
https://www.vulncheck.com/advisories/tooljet-database-before-3.16.44-privilege-escalation-via-join-tables

Check your stack JSON