Skip to contentTwentyhq Twenty vulnerabilities
- twentyhq twentyTwenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQLCVE-2026-1057639.6 Critical
- twentyhq twentyTwenty: Field-level read bypassCVE-2026-850557.1 High
- twentyhq twentyTwenty before 2.35.0 Permission Bypass via groupBy-with-records QueryCVE-2026-927717.1 High
- twentyhq twentyTwenty Open Redirect via OAuth Propagator CallbackCVE-2026-822745.3 Medium
- twentyhq twentyTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL ExecutionCVE-2026-730699.1 Critical
- twentyhq twentyTwenty: Cross-workspace IDOR in AgentTurnResolverCVE-2026-555837.6 High
- twentyTwenty: SQL Injection via the timeZone fieldCVE-2026-466249.9 Critical
- twentyTwenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)CVE-2026-447298.7 High
- twentyhq twentytwenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalizationCVE-2026-339758.3 High
- twentyhq twentyTwenty: Stored XSS via BlockNote FileBlockCVE-2026-354515.7 Medium
- twentyTwenty: SSRF protection bypass via HTTP redirect following in secure HTTP clientCVE-2026-270235.0 Medium
- twentyThe CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.CVE-2024-284355.4 Medium