CVE-2026-70642: ToolJet < 3.21.94 Authorization Bypass via app-environments/init
ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editingversionid from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJetto a version that resolves this vulnerability.Fixed in 3.21.94Patch e5f387a
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ToolJet user can exploit it. The attacker needs an editing_version_id associated with an app in another workspace.
What information can be exposed?
The endpoint can disclose the other workspace app version's name, description, status, current environment ID, and app ID. The available data indicates information disclosure only; no integrity or availability impact is described.
Are installations affected by default?
The issue is reachable through the app environments initialization endpoint and does not require user interaction. Exploitation requires a low-privileged authenticated account rather than unauthenticated network access.
How can I check whether an instance is vulnerable?
ToolJet versions before 3.21.94 are affected. In an authorized test, an authenticated user could request /api/app-environments/init with an editing_version_id from a different workspace and check whether version metadata is returned.