Threats tagged 'ghsa-98fp-fq2v-fr4p'

ToolJet versions from 3.20.2-lts up to but not including 3.20.242-lts contain an authorization bypass vulnerability in the SignupDisableGuard component. This flaw causes the system to treat the string 'false' in the signup setting as truthy, thereby failing to enforce instance-level signup restrictions. As a result, unauthenticated attackers can send POST requests to the /api/signup endpoint without specifying an organizationId, allowing them to create accounts, join the default workspace, and obtain valid sessions.