twentyhq has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 6.8 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-105763Critical· 9.6Twenty is an open-source CRM (customer relationship management) platform53CVE-2026-92771Medium· 6.5Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks48CVE-2026-85055High· 7.1Twenty is an open-source CRM (customer relationship management) platform39CVE-2026-82274Medium· 4.7Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL38
twentyhq vulnerabilities
CVEs affecting twentyhq, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-105763Critical· 9.6Twenty is an open-source CRM (customer relationship management) platform
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a wor…
CVE-2026-85055High· 7.1Twenty is an open-source CRM (customer relationship management) platform
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with…
CVE-2026-92771Medium· 6.5PoCTwenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue…
CVE-2026-82274Medium· 4.7PoCTwenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect us…