What’s Vulnerable › Vulnerabilities

CVE-2022-23067: ToolJet - Token Leakage via Referer Header

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-18 · updated 2026-06-17
• Weakness: CWE-200

Description

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

Affected products

• ToolJet: from 0.5.0 through 1.2.2

References

• https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067
• https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067

Get alerted when CVE-2022-23067 or the next vulnerability affects your stack