CVE-2026-70642

Description

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.

References

https://www.vulncheck.com/advisories/tooljet-authorization-bypass-via-app-environments-init

https://github.com/ToolJet/ToolJet/pull/18137

https://github.com/ToolJet/ToolJet/commit/e5f387a0e6fd8c9627d3e12418a2ae33a00b08d0

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4