Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873.
Published: 2026-11-12
Score: n/a
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Thu, 12 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873.
Title ToolJet < 3.21.94 Missing Authorization via App Export Endpoint
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Thu, 12 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Description ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers.
Title ToolJet < 3.21.94 Missing Authorization via App Export Endpoint
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published:

Updated: 2026-11-12T15:50:14.177Z

Reserved: 2026-08-04T20:17:18.298Z

Link: CVE-2026-70641

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Rejected

Published: 2026-11-12T16:19:12.957

Modified: 2026-11-12T16:19:12.957

Link: CVE-2026-70641

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.