Threats tagged 'ghsa-8vj5-g7mc-63c3'

A vulnerability in ToolJet versions up to 3.20.256-lts and 3.21.93-beta affects the onboarding signup endpoint. The flaw exists in the activateUserWithPassword function, where manipulation of the email argument can bypass authentication. This vulnerability can be exploited remotely. Public exploit code has been disclosed. Upgrading to version 3.21.94-beta resolves the issue.