Cross-Tenant Data Access via Missing Authorization Validation

ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose table schemas, plant malicious tables, corrupt existing schemas, or permanently destroy victim data without any relationship to the target organization.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ToolJet before v3.16.208 contains a critical authorization bypass vulnerability affecting its database endpoints. Authenticated users can manipulate the organizationId path parameter to access, modify, and delete tables belonging to other organizations—effectively breaking tenant isolation. This vulnerability matters because ToolJet is a low-code platform used by organizations to build internal applications; attackers can extract victim organization IDs from publicly accessible app endpoints, then weaponize schema operation endpoints to exfiltrate sensitive data, inject malicious tables, corrupt database schemas, or execute destructive operations. Any organization using affected ToolJet versions with multi-tenant deployments faces complete data compromise across organizational boundaries, making this a critical risk for SaaS deployments and shared platform environments.

Casky's 283 matched skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Using Claude AI with extended reasoning, practitioners would identify detection signals including: suspicious cross-organization API requests where authenticated users query organizationId parameters they don't belong to (TA0004), reconnaissance activity where attackers enumerate victim organization IDs from public endpoints before pivoting (TA0006), anomalous schema modification patterns from users outside the organization, and bulk data extraction operations that violate normal access patterns. Casky's skill correlations would flag the characteristic exploit chain—public endpoint enumeration → organizationId extraction → unauthorized database schema queries → destructive table operations—enabling security teams to catch this specific authorization bypass before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82874.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-82874

Casky has 283 skills that investigate the attack patterns behind CVE-2026-82874. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn