CVE-2026-105763
CriticalCVSS 9.6Summary
Twenty is an open-source CRM platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.
Risk Assessment
Exposure of external service passwords (IMAP, SMTP, CalDAV) can lead to unauthorized access to employees' mailboxes and calendars, as well as privilege escalation and account takeover.
Recommendation
Immediately upgrade Twenty to version 2.7.0 or later, which fixes this vulnerability. Additionally, consider rotating all credentials that may have been exposed.
Other vulnerabilities in Twenty
See all- CVE-2026-73069Critical
Twenty before 2.15.0 allows a workspace administrator with DATA_MODEL permission to supply an unescaped expression for the TS_VECTOR field, leading to SQL injection and arbitrary PostgreSQL execution as the application user.
- CVE-2026-85055High
Twenty is an open-source CRM platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy.
- CVE-2026-92771Medium
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
- CVE-2026-82274Medium
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
- CVE-2026-33975High
Twenty (open source CRM) versions 1.18.0 and earlier have an SSRF vulnerability where protection in SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js normalizes such addresses to compressed hex form, but the isPrivateIp function only recognizes dotted-decimal notation.
Original NVD description (English source)
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS