GHSA-gwr6-mv6v-23f2: ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

Published Oct 28, 2026

Updated

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ToolJet to a version that resolves this vulnerability.
Fixed in 3.20.242-lts

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it by sending a POST request to /api/signup without an organizationId. No existing account, privileges, or user interaction are required.

Which deployments are exposed?

ToolJet versions from 3.20.2-lts before 3.20.242-lts are affected when the instance-level signup setting is represented as the string "false." In that condition, the signup restriction is not enforced.

What access does successful exploitation provide?

An attacker can create an account, join the default workspace, and obtain a valid session.

GHSA-gwr6-mv6v-23f2: ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are exposed?

What access does successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are exposed?

What access does successful exploitation provide?