CVE-2026-126795
ToolJet Onboarding Signup Endpoint util.service.ts activateUserWithPassword missing authentication
A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure.
Fixes and workarounds
Fix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: VulDBFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: VulDBFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: VulDBAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| ToolJet n/a |
3.20.256-lts (affected) 3.21.93-beta (affected) 3.21.94-beta (unaffected) |
CNA: VulDB |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 6.9 medium |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | CNA: VulDB |
| 3.1 / 7.3 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | CNA: VulDB |
| 3.0 / 7.3 high |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | CNA: VulDB |
| 2.0 / 7.5 high |
AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C | CNA: VulDB |
Exploit evidence
- https://github.com/ToolJet/ToolJet/security/advisories/GHSA-rrx6-r9rr-g396
exploit · CNA: VulDB
References
- https://vuldb.com/vuln/435971CNA: VulDB · vdb-entry, technical-description
- https://vuldb.com/vuln/435971/ctiCNA: VulDB · signature, permissions-required
- https://vuldb.com/cve/CVE-2026-126795CNA: VulDB · third-party-advisory
- https://vuldb.com/submit/996374CNA: VulDB · third-party-advisory
- https://github.com/ToolJet/ToolJet/security/advisories/GHSA-rrx6-r9rr-g396CNA: VulDB · exploit
- https://github.com/ToolJet/ToolJet/pull/18851CNA: VulDB · issue-tracking, patch
- https://github.com/ToolJet/ToolJet/commit/af8f17a745621ae418f1743440f63d315e8b8643CNA: VulDB · patch
- https://github.com/ToolJet/ToolJet/releases/tag/v3.21.94-betaCNA: VulDB · patch
- https://github.com/ToolJet/ToolJet/CNA: VulDB · product
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.