Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118685ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

Medium 6.5

In plain English

A medium-severity incorrect authorization in ToolJet from ToolJet. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.

Affected products (as reported)

Vendor	Product	Versions
ToolJet	ToolJet	3.20.2-lts – before 3.20.242-lts

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-gwr6-mv6v-23f2) vendor-advisory
VulnCheck Advisory: ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard third-party-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2 exploit