Threats affecting pkg:github/tooljet/ToolJet

CVE-2026-126795 is a vulnerability in ToolJet versions 3.20.256-lts and 3.21.93-beta affecting the Onboarding Signup Endpoint. The flaw exists in the activateUserWithPassword function, where manipulation of the email argument can bypass authentication. This vulnerability can be exploited remotely without privileges or user interaction. A public exploit disclosure exists. Upgrading to version 3.21.94-beta resolves the issue.

ToolJet versions from 3.20.2-lts up to but not including 3.20.242-lts contain an authorization bypass vulnerability in the SignupDisableGuard component. This flaw causes the system to treat the string 'false' in the signup setting as truthy, thereby failing to enforce instance-level signup restrictions. As a result, unauthenticated attackers can send POST requests to the /api/signup endpoint without specifying an organizationId, allowing them to create accounts, join the default workspace, and obtain valid sessions.