← Vulnerability feed

Vulnerability record · CVE-2022-23067 · published 18 May 2022

CVE-2022-23067: Tooljet information exposure vulnerability

Tooljet · Tooljet

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

8.8 CVSS 3.1 High EPSS 1.3% · top 31.0% CWE-200 · Information exposure
8.8CVSS 3.1 base score, v2 6.8
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101 PatchThird Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067 ExploitThird Party Advisory
https://github.com/ToolJet/ToolJet/commit/eacbfc4c9da089ff9cda9edf8a1156390ae8a101 PatchThird Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23067 ExploitThird Party Advisory

Track CVE-2022-23067 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-54344Tooljet os command injection vulnerabilityToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates…EPSS 0.36%8.8CVE-2022-3019Tooljet improper access control vulnerabilityThe forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comme…EPSS 0.93%8.8CVE-2022-2631Tooljet improper access control vulnerabilityImproper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.EPSS 1.2%8.0CVE-2022-2037Tooljet vulnerabilityExcessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.EPSS 1.1%7.5CVE-2022-27978Tooljet vulnerabilityTooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.EPSS 1.0%7.5CVE-2022-3422Tooljet improper privilege management vulnerabilityAccount Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the fo…EPSS 0.86%6.5CVE-2022-4111Tooljet vulnerabilityUnrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.EPSS 0.80%5.4CVE-2022-27979Tooljet cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected…EPSS 0.48%

Source: NIST National Vulnerability Database (record CVE-2022-23067), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.