Tooljet - vulnerabilities (CVEs)

23 CVEs in 2 products, 1 in the last 30 days, newest from 2026-10-28.

Products

Tooljet - 19 CVEs
Tooljettooljet - 6 CVEs

Newest CVEs of Tooljet

CVE-2026-118685 - CVSS 6.9 (medium), 2026-10-28: ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy,…
CVE-2026-82875 - CVSS 5.5 (medium), 2026-08-31: ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without…
CVE-2026-82874 - CVSS 9.9 (critical), 2026-08-31: ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db…
CVE-2026-82873 - CVSS 5.3 (medium), 2026-08-31: ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to…
CVE-2026-82872 - CVSS 9.1 (critical), 2026-08-31: ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table…
CVE-2026-82871 - CVSS 8.2 (high), 2026-08-31: ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations'…
CVE-2026-82870 - CVSS 9.6 (critical), 2026-08-31: ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or…
CVE-2026-82869 - CVSS 8.2 (high), 2026-08-31: ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all…
CVE-2026-73068 - CVSS 5.9 (medium), 2026-08-11: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet…
CVE-2026-54344 - CVSS 8.8 (high), 2026-07-08: ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates…
CVE-2026-55411 - CVSS 6.8 (medium), 2026-06-25: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the…
CVE-2026-55412 - CVSS 8.3 (high), 2026-06-25: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's…
CVE-2026-55413 - CVSS 9.4 (critical), 2026-06-25: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any…
CVE-2022-27979 - CVSS 5.4 (medium), 2023-04-26: A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the…
CVE-2022-27978 - CVSS 7.5 (high), 2023-04-26: Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
CVE-2022-4111 - CVSS 6.5 (medium), 2022-11-22: Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
CVE-2022-3422 - CVSS 9.8 (critical), 2022-10-07: Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the…
CVE-2022-3348 - CVSS 6.5 (medium), 2022-09-28: Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is…
CVE-2022-3019 - CVSS 8.8 (high), 2022-08-29: The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's…
CVE-2022-2631 - CVSS 9.8 (critical), 2022-08-02: Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.
CVE-2022-2037 - CVSS 9.8 (critical), 2022-06-09: Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
CVE-2022-23068 - CVSS 5.4 (medium), 2022-05-18: ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field…
CVE-2022-23067 - CVSS 8.8 (high), 2022-05-18: ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup…