CVE-2026-126795 | ToolJet up to 3.20.256-lts/3.21.93-beta Onboarding Signup Endpoint util.service.ts activateUserWithPassword email missing authentication (GHSA-rrx6-r9rr-g396)

November 11, 2026 Yanac

A vulnerability labeled as critical has been found in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication.

This vulnerability is registered as CVE-2026-126795. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The affected component should be upgraded.

The vendor was contacted early about this disclosure.VulDB Recent EntriesRead More