CVE-2026-70642

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an...

CVE-2026-70642 ToolJet < 3.21.94 Authorization Bypass via app-environments/init

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an...

EUVD-2026-124531

ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an...

CVE-2026-70642

ToolsJet versions before 3.21.94 are vulnerable to an authorization bypass in the /api/app-environments/init endpoint. Because the lookup for editing_version_id is not scoped to the caller's organization, authenticated users can retrieve app version metadata—including version name, description, s...