Skip to content
OpenAdvisories

Vendor

twentyhq

11 known vulnerabilities.

Products

twenty 11
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-85055

    Twenty: Field-level read bypass

    Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an…

    twentyhq twenty
  • High 7.6
    CVE-2026-55583

    Twenty: Cross-workspace IDOR in AgentTurnResolver

    Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/meta…

    twentyhq twenty
  • High 8.7
    CVE-2026-44729

    Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)

    Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Option…

    twentyhq twenty
  • High 8.3
    CVE-2026-33975

    twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization

    Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-…

    twentyhq twenty