Live › vulnerability › CVE-2026-118685
Go to dashboardToolJet's SignupDisableGuard treats the string setting 'false' as truthy, so instance-level signup restrictions are not enforced. An unauthenticated attacker can POST to /api/signup without an organizationId to create an account, join the default workspace and receive a valid session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted ToolJet instances on 3.20.2-lts before 3.20.242-lts that rely on the instance-level signup restriction to keep outsiders out. Instances reachable from the internet are the main concern, since the bypass needs no account. Instances that are not reachable from untrusted networks, or that use a different identity gate in front of signup, carry less risk.
No product ranges from the sources yet.
3.20.2-lts up to but not including 3.20.242-lts is affected.3.20.242-lts or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.
This page as .md · .json · in your agent: get_signal("CVE-2026-118685")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.