CVE-2026-118685EUVD-2026-112390GHSA-98FP-FQ2V-FR4PGHSA-GWR6-MV6V-23F2
ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.20.242-lts
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ToolJet ToolJet
From 3.20.2-lts · fixed in 3.20.242-lts