---
id: "CVE-2026-70642"
page: "https://infrastack.ai/live/CVE-2026-70642"
kind: "vulnerability"
aliases: ["CVE-2026-70642"]
title: "ToolJet: authenticated users can read other workspaces' app version metadata"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ToolJet", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["multi-tenant", "other", "self-hosted", "tooljet"]
not_affected_if: ["single-workspace", "trusted-users-only"]
published_at: "2026-11-12T16:19:13+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:45:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70642", "first_seen_at": "2026-11-12T16:44:02+00:00"}]
exploit_sources: []
---

# ToolJet: authenticated users can read other workspaces' app version metadata

Link for people: https://infrastack.ai/live/CVE-2026-70642 (this .md is for agents)

ToolJet, a low-code app builder, has an authorization bypass in its app environments init endpoint. A logged-in user can request another workspace's app version and read its name, description, status, environment ID and app ID.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ToolJet affected range not listed fixed no fixed version listed

## How to check

- Check the ToolJet version in use; the sources say versions before `3.21.94` are affected.
- Look for `/api/app-environments/init` in the deployed ToolJet instance's API.

## Fix

- Move to ToolJet `3.21.94` or later, per the sources; the fix is commit `e5f387a`.

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-70642

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/tooljet-authorization-bypass-via-app-environments-init
- [fix] Patch: github.com https://github.com/ToolJet/ToolJet/commit/e5f387a0e6fd8c9627d3e12418a2ae33a00b08d0

## From the sources

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_