CVE-2022-27978

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2023-04-26

Last modified

2026-07-09

Weaknesses

CWE-755

Affected products

• Tooljet (Tooljet)

References

• https://github.com/fourcube/security-advisories/blob/main/security-advisories/20220320-tooljet.md