EUVD-2026-68404

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

PT-2026-83749

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description Insufficient validation occurs when checking if the path organizationId matches the authenticated user's workspace during ToolJet DB table operations. This allows a workspace administrator to...

PT-2026-83752

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An authorization bypass exists in TooljetDB controller endpoints that accept organizationId from the URL path without verifying if it matches the authenticated user's workspace. This allows...

EUVD-2026-67694

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace...

CVE-2026-80049

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

EUVD-2026-65701

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-80049

Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

PT-2026-81874

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...

PT-2026-81484

Name of the Vulnerable Software and Affected Versions Airbyte Platform affected versions not specified Description An issue exists where the platform determines the workspace for authorization decisions based on a field supplied by the caller. The AuthorizationServerHandler copies recognized...

CVE-2026-48765

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765

CVE-2026-48765 affects TypeBot (a chatbot builder tool). Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential via handleUpdateOAuthCredentials using an attacker-controlled w...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48494

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview...