Medium severity · published Oct 28, 2026
CVE-2026-118685
ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
New
6.5
CVSS
–
EPSS
No
On KEV
Description
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
ToolJet · ToolJet
3.20.2-lts before 3.20.242-lts · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118685
vendor-advisory
https://github.com/ToolJet/ToolJet/security/advisories/GHSA-gwr6-mv6v-23f2
third-party-advisory
https://www.vulncheck.com/advisories/tooljet-3.20.2-lts-before-3.20.242-lts-signup-bypass-via-signupdisableguard
More from ToolJet
9.9
CVE-2026-82874
ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
9.6
CVE-2026-82870
ToolJet before v3.16.208 Cross-Tenant Database Manipulation
9.4
CVE-2026-55413
ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution
9.1
CVE-2026-82872
ToolJet before v3.16.208 Cross-Workspace Authorization Bypass
8.8
CVE-2026-54344
ToolJet GitHub Actions comment body shell injection exposes deployment secrets