What’s Vulnerable › Products

ToolJet vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your ToolJet version is affected

Latest ToolJet vulnerabilities

• CVE-2026-82875 — ToolJet before v3.16.208 Authorization Bypass via organizationId (CVSS 5.5)
• CVE-2026-82874 — ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db (CVSS 9.9)
• CVE-2026-82873 — ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export (CVSS 5.0)
• CVE-2026-82872 — ToolJet before v3.16.208 Cross-Workspace Authorization Bypass (CVSS 9.1)
• CVE-2026-82871 — ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes (CVSS 7.7)
• CVE-2026-82870 — ToolJet before v3.16.208 Cross-Tenant Database Manipulation (CVSS 9.6)
• CVE-2026-82869 — ToolJet Database before v3.16.44 Privilege Escalation via join_tables (CVSS 7.7)
• CVE-2026-73068 — ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables (CVSS 5.9)
• CVE-2026-54344 — ToolJet GitHub Actions comment body shell injection exposes deployment secrets (CVSS 8.8)
• CVE-2026-55413 — ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution (CVSS 9.4)
• CVE-2026-55412 — ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise (CVSS 8.3)
• CVE-2026-55411 — ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets (CVSS 6.8)
• CVE-2022-27979 — (CVSS 5.4)
• CVE-2022-27978 — (CVSS 7.5)
• CVE-2022-4111 — Improper Validation of Specified Quantity in Input in tooljet/tooljet (CVSS 6.5)
• CVE-2022-3422 — Improper Privilege Management in tooljet/tooljet (CVSS 7.5)
• CVE-2022-3348 — Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet (CVSS 4.9)
• CVE-2022-3019 — Improper Access Control in tooljet/tooljet (CVSS 8.8)
• CVE-2022-2631 — Improper Access Control in tooljet/tooljet (CVSS 8.8)
• CVE-2022-2037 — Excessive Attack Surface in tooljet/tooljet (CVSS 8.0)
• CVE-2022-23068 — ToolJet - HTML Injection in Invite New User (CVSS 5.4)
• CVE-2022-23067 — ToolJet - Token Leakage via Referer Header (CVSS 6.8)