CVE-2026-82873

Katalog CVE

CVSS 5.0 · Medium EPSS 0,31%

Kerentanan Authorization Bypass Through User-Controlled Key. Skor CVSS 3.1 5.0 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB table schemas across workspace boundaries and export app definitions across granular permission boundaries. Attackers can supply a body-provided organization_id parameter to access schemas from other workspaces, or bypass per-app authorization gates to export restricted app definitions within their workspace.

Rincian

Terbit di NVD

31 Agustus 2026

Terakhir diubah

10 September 2026

Status NVD

Deferred

CVSS 3.1

5.0 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-pqfh-276q-w3cp
• https://www.vulncheck.com/advisories/tooljet-through-3.0.0-ee-beta-2-cross-workspace-schema-disclosure-via-exp...