Skip to content
OpenAdvisories

Vendor

twentyhq

11 known vulnerabilities.

Products

twenty 11
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-105763

    Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

    Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plai…

    twentyhq twenty
  • Critical 9.1
    CVE-2026-73069

    Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

    Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/…

    twentyhq twenty
  • Critical 9.9
    CVE-2026-46624

    Twenty: SQL Injection via the timeZone field

    Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user …

    twentyhq twenty