{"schema":"threatline.record/2","record":{"id":"GHSA-gwr6-mv6v-23f2","aliases":["GHSA-gwr6-mv6v-23f2"],"summary":"Instance-level signup bypass when signup is disabled","details":"### Summary\n\nSignupDisableGuard incorrectly treated the signup setting as a boolean. Because the setting was returned as the string 'true' or 'false', the value 'false' evaluated as truthy in JavaScript. As a result, unauthenticated users could create accounts through the signup API even when instance-level signup was disabled.\n\n### Details\n\nThe guard retrieved the signup setting through getSettings(), which returned the raw database column value as a string. It then authorized the request using logic equivalent to:\r\n\r\nreturn request.body.organizationId || enableSignUp;\r\n\r\nWhen signup was disabled, enableSignUp contained the string 'false'. Since any non-empty string is truthy in JavaScript, this expression permitted signup requests without an organizationId.\r\nThe login-page UI correctly hid or disabled signup based on the configured toggle, but the corresponding server-side API restriction was ineffective. Accounts created through the exposed API were automatically added to the default workspace, and a successful signup response included a valid session token.\n\n### Proof of concept\n\nPrerequisites:\r\n- Run ToolJet.\r\n- Disable instance-level signup in the instance settings.\r\n- Ensure a default workspace exists.\r\nSend an unauthenticated request directly to the instance-level signup endpoint, omitting organizationId:\r\n\r\nPOST /api/signup\r\nContent-Type: application/json\r\n\r\n{\r\n  \"email\": \"attacker@example.com\",\r\n  \"password\": \"ExamplePassword123!\"\r\n}\r\n\r\nDespite signup being disabled, the API creates the user, automatically adds the account to the default workspace, and returns a valid session token.\r\nVerify that the new credentials or returned token can be used to authenticate and access resources available to a newly joined member of the default workspace.\n\n### Impact\n\nAn unauthenticated remote attacker could bypass an administrator’s signup restriction and create an account on an affected instance. The account would be automatically joined to the default workspace and immediately receive an authenticated session.\r\nThis could allow unauthorized access to workspace resources available to ordinary members, including applications, data, or functionality exposed under the default workspace’s permissions. The precise confidentiality and integrity impact depends on the workspace configuration and the privileges granted to newly created users.","categories":["Unclassified"],"product":"ToolJet","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/ToolJet/ToolJet/security/advisories/GHSA-gwr6-mv6v-23f2","source_modified_at":"2026-10-13T08:07:55Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"ToolJet","ecosystem":null},"range":"> 3.20.1-lts, <3.20.242-lts"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/ToolJet/ToolJet/security/advisories/GHSA-gwr6-mv6v-23f2","source_modified_at":"2026-10-13T08:07:55Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"ToolJet","ecosystem":null},"version":"3.20.242-lts"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-13T08:07:55Z","modified_at":"2026-10-13T08:07:55Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/ToolJet/ToolJet/security/advisories/GHSA-gwr6-mv6v-23f2","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-13T08:07:55Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T08:07:55Z","content_hash":"e727745fb84e1d98a861bec4a3b03379718dfa8f7e02a6e0430d9251a935481e"}}