Tooljet vulnerabilities

Products

• Tooljet 23
• Tooljet/tooljet 6

Newest

• tooljet ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard CVE-2026-118685 6.9 MediumOctober 28, 2026
• tooljet ToolJet before v3.16.208 Authorization Bypass via organizationId CVE-2026-82875 5.1 MediumAugust 31, 2026
• tooljet ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db CVE-2026-82874 9.4 CriticalAugust 31, 2026
• tooljet ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export CVE-2026-82873 5.3 MediumAugust 31, 2026
• tooljet ToolJet before v3.16.208 Cross-Workspace Authorization Bypass CVE-2026-82872 7.1 HighAugust 31, 2026
• tooljet ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes CVE-2026-82871 8.2 HighAugust 31, 2026
• tooljet ToolJet before v3.16.208 Cross-Tenant Database Manipulation CVE-2026-82870 7.0 HighAugust 31, 2026
• tooljet ToolJet Database before v3.16.44 Privilege Escalation via join_tables CVE-2026-82869 8.2 HighAugust 31, 2026
• tooljet ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables CVE-2026-73068 5.9 MediumAugust 11, 2026
• tooljet ToolJet GitHub Actions comment body shell injection exposes deployment secrets CVE-2026-54344 4.7 MediumJuly 8, 2026
• tooljet ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets CVE-2026-55411 6.8 MediumJune 25, 2026
• tooljet ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise CVE-2026-55412 8.3 HighJune 25, 2026
• tooljet ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution CVE-2026-55413 9.4 CriticalJune 25, 2026
• tooljet A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute... CVE-2022-27979 5.4 MediumApril 26, 2023
• tooljet Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to... CVE-2022-27978 7.5 HighApril 26, 2023
• tooljet, tooljet tooljet/tooljet +1 more Improper Validation of Specified Quantity in Input in tooljet/tooljet CVE-2022-4111 Fix available 6.5 MediumNovember 22, 2022
• tooljet, tooljet tooljet/tooljet +1 more Improper Privilege Management in tooljet/tooljet CVE-2022-3422 9.8 CriticalOctober 7, 2022
• tooljet, tooljet tooljet/tooljet +1 more Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet CVE-2022-3348 6.5 MediumSeptember 28, 2022
• tooljet, tooljet tooljet/tooljet +1 more Improper Access Control in tooljet/tooljet CVE-2022-3019 7.1 HighAugust 29, 2022
• tooljet, tooljet tooljet/tooljet +1 more Improper Access Control in tooljet/tooljet CVE-2022-2631 9.8 CriticalAugust 2, 2022
• tooljet, tooljet tooljet/tooljet +1 more Excessive Attack Surface in tooljet/tooljet CVE-2022-2037 9.8 CriticalJune 9, 2022
• tooljet ToolJet - HTML Injection in Invite New User CVE-2022-23068 5.4 MediumMay 18, 2022
• tooljet ToolJet - Token Leakage via Referer Header CVE-2022-23067 8.8 HighMay 18, 2022