{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tooljet-up-to-3.20.256-lts/3.21.93-beta/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tooljet:up_to_3_20_256_lts_3_21_93_beta:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-126795"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ToolJet up to 3.20.256-lts/3.21.93-beta"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ToolJet"],"content_html":"\u003cp\u003eCVE-2026-126795 has been identified in the ToolJet component Onboarding Signup Endpoint. The vulnerability exists within the activateUserWithPassword function in the file server/src/modules/onboarding/util.service.ts. Remote attackers can exploit this vulnerability through manipulation of the email argument, potentially resulting in missing authentication. The vulnerability has been publicly disclosed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade to ToolJet version 3.21.94-beta to resolve this issue.\u003c/p\u003e\n","date_modified":"2026-11-12T04:02:55Z","date_published":"2026-11-12T04:02:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-tooljet-auth-bypass-cve-2026-126795/","summary":"A vulnerability in the ToolJet Onboarding Signup Endpoint allows for potential remote authentication bypass via manipulation of the email argument.","title":"ToolJet: Authentication bypass vulnerability (CVE-2026-126795)","url":"https://feed.craftedsignal.io/briefs/2026-11-tooljet-auth-bypass-cve-2026-126795/"}],"language":"en","title":"CraftedSignal Threat Feed - ToolJet Up to 3.20.256-Lts/3.21.93-Beta","version":"https://jsonfeed.org/version/1.1"}