Priority MEDIUM 43
Twenty is an open-source CRM (customer relationship management) platform.
Vulnerabilities
14 records
TI-2026-58434 CVE-2026-85055
Twenty: Field-level read bypass
Priority LOW 32
Twenty is an open-source CRM (customer relationship management) platform.
TI-2026-62513 CVE-2026-92771 · GHSA-7q37-3m9h-f5mp
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Priority MEDIUM 64
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks.
TI-2026-56739 CVE-2026-82274 · GHSA-cx66-mrcp-c95r
Twenty Open Redirect via OAuth Propagator Callback
Priority MEDIUM 57
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL.
TI-2026-51276 CVE-2026-73069
Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
Priority HIGH 74
Twenty is an open-source CRM (customer relationship management) platform.
Priority HIGH 66
Twenty is an open-source CRM (customer relationship management) platform.
TI-2026-34280 CVE-2026-46624
Twenty: SQL Injection via the timeZone field
Priority HIGH 76
Twenty is an open source CRM.
TI-2026-32616 CVE-2026-44729
Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
Priority HIGH 73
Twenty is an open source CRM.
TI-2026-26316 CVE-2026-33975
twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization
Priority HIGH 69
Twenty is an open source CRM built with NestJS (Node.js).
TI-2026-27582 CVE-2026-35451
Twenty: Stored XSS via BlockNote FileBlock
Priority MEDIUM 59
Twenty is an open source CRM.
TI-2026-21496 CVE-2026-27023
Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client
Priority LOW 22
Twenty is an open source CRM.
TI-2026-21368 CVE-2026-26720 · GHSA-227p-wwrh-m869
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary…
Priority HIGH 82
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
TI-2024-18877 CVE-2024-28435 · GHSA-6cqh-4xr5-c65x
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
Priority MEDIUM 58
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
TI-2024-18876 CVE-2024-28434 · GHSA-x7hp-f23m-66mj
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in…
Priority HIGH 66
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.