Twentyhq vulnerabilities
We track 7 vulnerabilities in Twentyhq products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 6, 2026.
Latest Twentyhq vulnerabilities
- 9.6 Critical severity
twenty: Insufficiently Protected Credentials
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plain
- 7.1 High severity
twenty: Exposure of Sensitive Information to an Unauthorized Actor
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an
- 9.1 Critical severity
twenty: Improper Neutralization of Special Elements used in an SQL Command
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/m
- 7.6 High severity
twenty: Authorization Bypass Through User-Controlled Key
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metad
- 9.9 Critical severity
twenty: Improper Neutralization of Special Elements used in an OS Command
Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user c
- 8.7 High severity
twenty: Improper Neutralization of Input During Web Page Generation
Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using fileStream.pipe(res) without setting any Content-Type, Content-Disposition, or X-Content-Type-Options
- 8.3 High severity
twenty: Server-Side Request Forgery
Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-m