# CVE-2026-126795: ToolJet missing authentication in onboarding signup endpoint

Source: https://junglewise.ai/threats/cve-2026-126795-a-vulnerability-was-determined-in-tooljet-up-to-3-20-256-lts-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126795 · Severity: high · CVSS 7.3 · Published 2026-11-12

ToolJet is an open-source platform for building internal tools and dashboards. A flaw in the user signup/onboarding process allows attackers to manipulate email parameters to bypass authentication and activate accounts without proper credentials. This could lead to unauthorized access to internal applications built with ToolJet.

Technologies: [ToolJet](https://junglewise.ai/threats/technologies/tooljet). Vendors: [ToolJet](https://junglewise.ai/threats/vendors/tooljet).

## Quick answers

**Is CVE-2026-126795 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126795 being exploited in the wild.

**How severe is CVE-2026-126795?** High severity, with a CVSS score of 7.3, published 12 November 2026.

**Which products and versions are affected?** ToolJet up to 3.20.256-lts and 3.21.93-beta.

**Is there a fix for CVE-2026-126795?** Yes: fixed in 3.21.94-beta (commit af8f17a745621ae418f1743440f63d315e8b8643). Until then: Upgrade to version 3.21.94-beta or later immediately. Until patching is possible, restrict network access to the onboarding signup endpoint or disable public signup functionality.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12","note":"Vulnerability publicly disclosed"},{"kind":"patched","at":"2026-11-12","note":"Patch released as version 3.21.94-beta"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126795 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126795?** Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.21.94-beta (commit af8f17a745621ae418f1743440f63d315e8b8643)

Upgrade to version 3.21.94-beta or later immediately. Until patching is possible, restrict network access to the onboarding signup endpoint or disable public signup functionality.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-12","note":"Vulnerability publicly disclosed"},{"kind":"patched","at":"2026-11-12","note":"Patch released as version 3.21.94-beta"}]

## Technical details

A missing authentication vulnerability exists in the activateUserWithPassword function within the onboarding signup endpoint (server/src/modules/onboarding/util.service.ts). By manipulating the email argument, an attacker can trigger missing authentication checks during account activation. The attack is network-accessible, requires no prior authentication or user interaction, and allows unauthorized account activation.

## Affected products

- ToolJet ToolJet up to 3.20.256-lts and 3.21.93-beta

## References

- [https://github.com/ToolJet/ToolJet/](https://github.com/ToolJet/ToolJet/)
- [https://github.com/ToolJet/ToolJet/commit/af8f17a745621ae418f1743440f63d315e8b8643](https://github.com/ToolJet/ToolJet/commit/af8f17a745621ae418f1743440f63d315e8b8643)

## Related threats

- [ToolJet authorization bypass in app environments init endpoint](https://junglewise.ai/threats/cve-2026-70642-tooljet-before-3-21-94-fixed-in-commit-e5f387a-contains-an)
- [ToolJet authorization bypass in TooljetDB controller](https://junglewise.ai/threats/cve-2026-82875-tooljet-authorization-bypass-in-tooljetdb-controller)
- [ToolJet cross-tenant authorization bypass in tooljet-db endpoints](https://junglewise.ai/threats/cve-2026-82874-tooljet-cross-tenant-authorization-bypass-in-tooljet-db-endpoints)
- [ToolJet authorization bypass in resources export endpoint](https://junglewise.ai/threats/cve-2026-82873-tooljet-authorization-bypass-in-resources-export-endpoint)
- [ToolJet authorization bypass in database table operations](https://junglewise.ai/threats/cve-2026-82872-tooljet-authorization-bypass-in-database-table-operations)