CVE-2026-70641: ToolJet < 3.21.94 Missing Authorization via App Export Endpoint
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873.
Other sources
ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers.
— MITRE
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJetto a version that resolves this vulnerability.Fixed in 3.21.94
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated member of the same ToolJet workspace can exploit it if they have permission to create apps. They do not need permission to view or edit the target app.
What does an attacker need to do?
The attacker must send a POST request to /api/v2/resources/export and supply the ID of an app in their workspace. Arbitrary app IDs can be used for apps the attacker is not authorized to access.
What information can be exposed?
Exported app definitions can include pages, components, queries, data source references, versions, and event handlers. The issue affects confidentiality; no integrity or availability impact is stated.
How can I determine whether a deployment is affected?
ToolJet versions before 3.21.94 are affected. Review export-endpoint activity for POST requests to /api/v2/resources/export by workspace members whose permissions do not allow viewing or editing the requested app.