High severity · published Aug 31, 2026
CVE-2026-82869
ToolJet Database before v3.16.44 Privilege Escalation via join_tables
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
ToolJet · ToolJet
before 3.16.44 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82869
github.com
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-7vj5-wxfm-gmfq
www.vulncheck.com
https://www.vulncheck.com/advisories/tooljet-database-before-3.16.44-privilege-escalation-via-join-tables
More from ToolJet
9.9
CVE-2026-82874
ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
9.6
CVE-2026-82870
ToolJet before v3.16.208 Cross-Tenant Database Manipulation
9.4
CVE-2026-55413
ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution
9.1
CVE-2026-82872
ToolJet before v3.16.208 Cross-Workspace Authorization Bypass
8.8
CVE-2026-54344
ToolJet GitHub Actions comment body shell injection exposes deployment secrets