CVE-2026-118685

The record

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.

Affected packages

Related vulnerabilities

• CVE-2026-63414 Shopify App is a Rails engine for building Shopify applications. CWE-863
• CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-863
• CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-863
• CVE-2026-58412 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP… CWE-863
• CVE-2026-55493 HotCRP is conference review software. CWE-863
• CVE-2026-55098 Arc is an open, SQL-native time-series database for telemetry. CWE-863
• CVE-2026-115830 In Secret Server versions earlier than 12.3.1, a user under certain conditions could… CWE-863
• CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins… CWE-863