Advisories · Technology

ToolJet.

Every CVE that names ToolJet among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118685 CVE record

CVSS 6.9 Medium

ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
- ToolJet
- Broken access control
Not analysed yet 28 Oct 2026
CVE-2026-82875 CVE record

CVSS 5.1 Medium

ToolJet before v3.16.208 Authorization Bypass via organizationId
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82874 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82873 CVE record

CVSS 5.3 Medium

ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82872 CVE record

CVSS 7.1 High

ToolJet before v3.16.208 Cross-Workspace Authorization Bypass
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82871 CVE record

CVSS 8.2 High

ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82870 CVE record

CVSS 7.0 High

ToolJet before v3.16.208 Cross-Tenant Database Manipulation
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-82869 CVE record

CVSS 8.2 High

ToolJet Database before v3.16.44 Privilege Escalation via join_tables
- ToolJet
- Broken access control
Not analysed yet 31 Aug 2026
CVE-2026-73068 CVE record

CVSS 5.9 Medium

ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables
- ToolJet
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-54344 CVE record

CVSS 4.7 Medium

ToolJet GitHub Actions comment body shell injection exposes deployment secrets
- ToolJet
- Command injection
Not analysed yet 8 Jul 2026
CVE-2026-55411 CVE record

CVSS 6.8 Medium

ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets
- ToolJet
- Broken access control
Not analysed yet 25 Jun 2026
CVE-2026-55412 CVE record

CVSS 8.3 High

ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise
- ToolJet
- Server-side request forgery (SSRF)
Not analysed yet 25 Jun 2026
CVE-2026-55413 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution
- ToolJet
- Code injection
Not analysed yet 25 Jun 2026
CVE-2022-23068 CVE record

CVSS 5.4 Medium

ToolJet - HTML Injection in Invite New User
- ToolJet
- Other injection
Not analysed yet 18 May 2022
CVE-2022-23067 CVE record

CVSS 8.8 High

ToolJet - Token Leakage via Referer Header
- ToolJet
- Information disclosure
Not analysed yet 18 May 2022