CVE-2026-126795: ToolJet Onboarding Signup Endpoint util.service.ts activateUserWithPassword missing authentication
A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ToolJetto a version that resolves this vulnerability.Fixed in 3.21.94-betaPatch af8f17a745621ae418f1743440f63d315e8b8643
Event History
Frequently Asked Questions
Which deployments are affected?
ToolJet versions up to 3.20.256-lts and 3.21.93-beta are affected in the Onboarding Signup Endpoint, specifically the activateUserWithPassword function in server/src/modules/onboarding/util.service.ts.
What does an attacker need to exploit this issue?
The attack can be performed remotely without authentication or user interaction by manipulating the email argument sent to the affected onboarding signup functionality. Public exploit information is available.
What is the remediation?
Upgrade the affected component to ToolJet version 3.21.94-beta or later. The vendor fix is identified as commit af8f17a745621ae418f1743440f63d315e8b8643.