CVE-2026-70641

Published Nov 12, 2026 CVSS n/a EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873.

No data.

No data available yet.

No solution or workaround provided in the CVE record

No advisories available

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

No reference.

History

Type	Values Removed	Values Added
Description	ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873.
Title	ToolJet < 3.21.94 Missing Authorization via App Export Endpoint
Weaknesses	CWE-862
References	https://github.com/ToolJet/ToolJet/commit/1ba63f277595c5c8c49186fd6e04e70327f498b2 https://github.com/ToolJet/ToolJet/pull/18848 https://www.vulncheck.com/advisories/tooljet-missing-authorization-via-app-export-endpoint
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Type	Values Removed	Values Added
Description		ToolJet before 3.21.94, fixed in commit 1ba63f2, contains a missing authorization vulnerability in the app export endpoint that allows authenticated workspace members with app creation permission to export apps they cannot view or edit. Attackers can send POST requests to /api/v2/resources/export with arbitrary app IDs from the same workspace to retrieve full app definitions, including pages, components, queries, data source references, versions, and event handlers.
Title		ToolJet < 3.21.94 Missing Authorization via App Export Endpoint
Weaknesses		CWE-862
References		https://github.com/ToolJet/ToolJet/commit/1ba63f277595c5c8c49186fd6e04e70327f498b2 https://github.com/ToolJet/ToolJet/pull/18848 https://www.vulncheck.com/advisories/tooljet-missing-authorization-via-app-export-endpoint
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`