ToolJet vulnerabilities

CVEs per yearBy the year they were published

1. 20228
2. 202613

Newest CVEs

• CVE-2026-118685

  ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

  ToolJet · ToolJet

  Medium6.9
• CVE-2026-82875

  ToolJet before v3.16.208 Authorization Bypass via organizationId

  ToolJet · ToolJet

  Medium5.1
• CVE-2026-82874

  ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

  ToolJet · ToolJet

  Critical9.4
• CVE-2026-82873

  ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export

  ToolJet · ToolJet

  Medium5.3
• CVE-2026-82872

  ToolJet before v3.16.208 Cross-Workspace Authorization Bypass

  ToolJet · ToolJet

  High7.1
• CVE-2026-82871

  ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

  ToolJet · ToolJet

  High8.2
• CVE-2026-82870

  ToolJet before v3.16.208 Cross-Tenant Database Manipulation

  ToolJet · ToolJet

  High7.0
• CVE-2026-82869

  ToolJet Database before v3.16.44 Privilege Escalation via join_tables

  ToolJet · ToolJet

  High8.2
• CVE-2026-73068

  ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables

  ToolJet · ToolJet

  Medium5.9
• CVE-2026-54344

  ToolJet GitHub Actions comment body shell injection exposes deployment secrets

  ToolJet · ToolJet

  Medium4.7