CVE-2026-118685: ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJetto a version that resolves this vulnerability.Fixed in 3.20.242-lts
Event History
Frequently Asked Questions
Which deployments are exposed?
ToolJet versions from 3.20.2-lts before 3.20.242-lts are affected when the signup setting is represented as the string "false". In that condition, instance-level signup restrictions are not enforced.
What does an attacker need to exploit this?
No authentication, privileges, or user interaction are required. An attacker can send a POST request to /api/signup without an organizationId.
What access can exploitation provide?
Successful exploitation creates an account, joins it to the default workspace, and provides the attacker with a valid session.
How can I determine whether exploitation may have occurred?
Review account creation and request records for unauthenticated POST requests to /api/signup that omitted an organizationId, particularly accounts added to the default workspace.