CVE-2026-118685 Details
Description
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.
An authorization bypass vulnerability has been identified in ToolJet versions 3.20.2-lts prior to 3.20.242-lts. The issue resides in the SignupDisableGuard, which incorrectly interprets the signup setting 'false' as truthy. This flaw allows unauthenticated attackers to send POST requests to the signup API without an organizationId, bypassing instance-level signup restrictions. Exploitation of this vulnerability enables the creation of user accounts that are automatically added to the default workspace, along with a valid session token.
Users can update to ToolJet version 3.20.242-lts or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2 | CISA-ADP | |
| https://github.com/ToolJet/ToolJet/security/advisories/GHSA-gwr6-mv6v-23f2 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/tooljet-3.20.2-lts-before-3.20.242-lts-signup-bypass-via-signupdisableguard | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ToolJet | >= 3.20.2-lts, < 3.20.242-lts (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |