PT-2026-145666

CVE-2026-126795

Published

2026-11-12

Updated

2026-11-12

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.21.94-beta

Description An issue exists in the Onboarding Signup Endpoint within the activateUserWithPassword() function located in the server/src/modules/onboarding/util.service.ts file. A remote attacker can manipulate the email argument to bypass authentication.

Recommendations Upgrade to version 3.21.94-beta.

Exploitability

Exploit

Fix

Impacts

Researchers

Xianggudahundun

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-306: Missing Authentication for Critical Function