Description
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
High · 7.5
CVE-2022-27978
EUVD-2022-32464GHSA-wxm6-gcq6-r4p5
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP reque…
Published Apr 26, 2023 · Updated Jul 9, 2026 · Assigned by mitre