ToolJet <= 1.27.0 Vulnerability: Critical Database Access Flaw
- Severity
- CRITICAL
- CVSS
- 9.6
- Affected component
- tooljet (npm)
- Affected versions
- < 1.27.0
- Patched version
- 3.16.208
ToolJet versions before 1.27.0 contain a critical vulnerability that allows builder-role users to access and modify databases across tenant boundaries.
What happened
ToolJet before version 1.27.0 fails to validate organizationId ownership in database write and destroy routes. This oversight allows any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit this vulnerability to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
The vulnerability was first flagged on 2026-08-31T09:17:07.863000+00:00 and confirmed on 2026-08-31T10:12:11.165150+00:00. It has been assigned CVE-2026-82870 with a CVSS score of 9.6, indicating a critical severity level.
What to do about it
- Upgrade to ToolJet version 3.16.208 or later to mitigate the risk of unauthorized database modifications.
- Review your organization's use of ToolJet and ensure all instances are updated to the patched version.
- Monitor the NVD and osv sources for any further updates or additional vulnerabilities.
How 0Day would have caught this
tooljet is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using ToolJet version 1.27.0 or earlier.
What should I do right now?
Upgrade to ToolJet version 3.16.208 or later immediately.
Has this vulnerability been exploited in the wild?
No, there are no reports of this vulnerability being exploited in the wild.
Where can I find more information about this vulnerability?
Consult the NVD and osv sources for detailed information and updates.