Authorization Bypass in ToolJet Affecting Instance-Level Signup Controls

CVE-2026-118685

What is CVE-2026-118685?

ToolJet versions before 3.20.242-lts contain a vulnerability in the SignupDisableGuard component, where the configuration setting for instance-level signup restrictions is improperly evaluated. Specifically, the 'false' string is treated as a truthy value, allowing unauthenticated attackers to exploit this flaw. By sending POST requests to the /api/signup endpoint without providing a valid organizationId, attackers can create accounts and gain access to the default workspace, thereby receiving valid session tokens and potentially leading to unauthorized actions within the application.

References