CVE-2026-118685: medium-severity vulnerability in ToolJet
ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.2%
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
ToolJet · ToolJetpublic PoCs found — 1
cve_referencegithub.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ToolJet
In the same product, most dangerous first.
CVE-2022-23067HIGHToolJet - Token Leakage via Referer HeaderEPSS 1.3%CVE-2022-23068MEDIUMToolJet - HTML Injection in Invite New UserEPSS 0.6%CVE-2026-82872HIGHToolJet before v3.16.208 Cross-Workspace Authorization BypassEPSS 0.5%CVE-2026-82874CRITICALToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-dbEPSS 0.4%CVE-2026-82870HIGHToolJet before v3.16.208 Cross-Tenant Database ManipulationEPSS 0.4%CVE-2026-82871HIGHToolJet before v3.16.208 Cross-Organization Data Read via Database RoutesEPSS 0.4%