CVE-2026-126795

A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure.

• CWE-287
• CWE-306

• https://github.com/ToolJet/ToolJet/
• https://github.com/ToolJet/ToolJet/commit/af8f17a745621ae418f1743440f63d315e8b8643
• https://github.com/ToolJet/ToolJet/pull/18851
• https://github.com/ToolJet/ToolJet/releases/tag/v3.21.94-beta
• https://github.com/ToolJet/ToolJet/security/advisories/GHSA-rrx6-r9rr-g396
• https://vuldb.com/cve/CVE-2026-126795
• https://vuldb.com/submit/996374
• https://vuldb.com/vuln/435971
• https://vuldb.com/vuln/435971/cti

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126780Webmin through 2.670 contains a privilege escalation vulnera…7.2
• CVE-2026-126781Webmin through 2.670 contains a users file injection vulnera…7.5
• CVE-2026-126784Missing rate limiting, per-account submission quota and geog…4.3
• CVE-2026-126785A vulnerability has been found in rmalright TR-VISION HOME 2…8.8
• CVE-2026-126792A memory-safety flaw in the key-management request-building …4.7
• CVE-2026-126793An untrusted search path issue in Aurora PostgreSQL dialect …8
• CVE-2026-126797NextScan 1.1.0 through 1.2.0 contains an authentication bypa…9.8
• CVE-2026-126798NextScan 1.1.0 through 1.2.0 contains a stored cross-site sc…4.7
• CVE-2026-126799Gotenberg 8.31.0 before 8.38.0 contains a server-side reques…7.5
• CVE-2026-1268The Dynamic Widget Content plugin for WordPress is vulnerabl…6.4
• CVE-2026-126800Hydro @hydrooj/ui-default before 4.59.1 contains a stored cr…8.7
• CVE-2026-126801Rote 1.2.0 through 2.6.0 contains an authorization bypass in…8.8