CVE-2026-82873: Tooljet

Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days.

ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB table schemas across workspace boundaries and export app definitions across granular permission boundaries. Attackers can supply a body-provided organization_id parameter to access schemas from other workspaces, or bypass per-app authorization gates to export restricted app definitions within their workspace.

Affected products

• Tooljet Tooljet: up to and including 3.0.0-ee-beta.2

Published 2026-08-31. Last modified 2026-09-10.