CVE-2026-85055
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Twenty is an open-source CRM platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy.
Risk Assessment
An attacker can reconstruct values of fields they are not authorized to access, breaching data confidentiality in the CRM. This may lead to leakage of sensitive business information and violation of security policies.
Recommendation
Update Twenty to version 2.22.0 or later. Until then, restrict the ability to create persisted views and filters, and monitor for unusual query patterns.
Other vulnerabilities in Twenty
See all- CVE-2026-73069Critical
Twenty before 2.15.0 allows a workspace administrator with DATA_MODEL permission to supply an unescaped expression for the TS_VECTOR field, leading to SQL injection and arbitrary PostgreSQL execution as the application user.
- CVE-2026-92771Medium
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
- CVE-2026-82274Medium
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
- CVE-2026-33975High
Twenty (open source CRM) versions 1.18.0 and earlier have an SSRF vulnerability where protection in SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js normalizes such addresses to compressed hex form, but the isPrivateIp function only recognizes dotted-decimal notation.
Original NVD description (English source)
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy. This issue is fixed in version 2.22.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS