CVE-2026-126795 · Runtime
NO FIX YET · SEE WHAT TO DO
ToolJet's onboarding signup endpoint mishandles the email argument in activateUserWithPassword, so authentication can be bypassed remotely. Per the description, an attacker can reach the endpoint over the internet and the exploit has been publicly disclosed.
first public Nov 9, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
ToolJet deployments up to 3.20.256-lts and 3.21.93-beta whose onboarding signup endpoint is reachable from the network. The flaw is in the signup path, so instances with signup closed or behind access controls are less exposed; the sources do not say more.
Not affected if unknown
Who cares self-hosted, tooljet
3.20.256-lts and 3.21.93-beta are affected.server/src/modules/onboarding/util.service.ts if you build from source.3.21.94-beta (per the description; the patch commit is af8f17a745621ae418f1743440f63d315e8b8643).A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.