https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T17:42:02.994881+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-82870 CVE-2026-82870 — ToolJet before v3.16.208 Cross-Tenant Database Manipulation 2026-10-02T17:42:03.010094+00:00

Affected: ToolJet

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.