ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Nov 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers. | |
| Title | ToolJet < 3.21.94 Missing Authorization via App Export Endpoint | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: REJECTED
Assigner: VulnCheck
Published:
Updated: 2026-11-12T15:50:14.177Z
Reserved: 2026-08-04T20:17:18.298Z
Link: CVE-2026-70641
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses