ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy, so instance-level signup restrictions are not enforced. Unauthenticated attackers can send POST requests to /api/signup without an organizationId to create an account, join the default workspace, and receive a valid session.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…oolJet/security/advisories/GHSA-gwr6-mv6v-23f2 Üretici bülteni
• vulncheck.com/…0.242-lts-signup-bypass-via-signupdisableguard Üçüncü taraf

Kayıt geçmişi

1. 28 Eki 2026 21:59Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
• 9,1 CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
• 7,1 CVE-2026-118676n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
• 7,1 CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
• 7,1 CVE-2026-118642n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
• 5,4 CVE-2026-118640n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass