CVE-2026-70642
Published:November 12, 2026
Updated:November 13, 2026
ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.
Affected Packages
https://github.com/ToolJet/ToolJet.git (GITHUB):
Affected version(s) >=v2.45.0 <v3.21.94-beta || >=CE-LTS-2.50.0 <v3.21.94-beta || >=v3.0.0-ce-beta <v3.21.94-beta || >=v3.1.0-ce <v3.21.94-beta || >=v3.16.0-lts <v3.21.94-beta || >=v3.20.0-lts <v3.21.94-beta || >=v3.21.6-beta <v3.21.94-betaFix Suggestion:
Update to version v3.21.94-betaRelated Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Authorization Bypass Through User-Controlled Key
EPSS
Base Score:
0.21