CVE-2026-70642

CVSS 5.3 (medium) · published 2026-11-12

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.

Weakness: CWE-639

Source: NVD CVE-2026-70642

References

• https://github.com/ToolJet/ToolJet/commit/e5f387a0e6fd8c9627d3e12418a2ae33a00b08d0
• https://github.com/ToolJet/ToolJet/pull/18137
• https://www.vulncheck.com/advisories/tooljet-authorization-bypass-via-app-environments-init

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.