TOOLJET · CVE-2026-70642 · Other
NO FIX YET · SEE WHAT TO DO
ToolJet, a low-code app builder, has an authorization bypass in its app environments init endpoint. A logged-in user can request another workspace's app version and read its name, description, status, environment ID and app ID.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host ToolJet or run it with user accounts in more than one workspace or organization are exposed, because the flaw lets an authenticated user read metadata across workspaces. Single-tenant deployments with only trusted users are lower risk. The sources do not say whether managed ToolJet cloud is patched.
Not affected if single-workspace, trusted-users-only
Who cares multi-tenant, self-hosted, tooljet
3.21.94 are affected./api/app-environments/init in the deployed ToolJet instance's API.3.21.94 or later, per the sources; the fix is commit e5f387a.ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.