Twenty CRM CVE-2026-105763

Exploitation requires an authenticated low-privilege account in the target Twenty workspace (PR:L) and that the workspace contains at least one connected account configured via IMAP, SMTP, or CalDAV (password-based) credentials - these are the only credentials exposed by the ConnectedAccountDTO.connectionParameters field. Workspaces using exclusively Google or Microsoft OAuth-based connections are not affected because those flows store no plaintext password. Affected versions are 1.20.10 up to (but not including) 2.7.0. The limiting factor is the membership requirement: a fully external, unauthenticated attacker cannot reach the query, so realistic risk centers on malicious insiders, over-provisioned members, or compromised member accounts.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H) is internally consistent with the description: a GraphQL query over the network, low attack complexity, and only low privileges (any normal workspace member) are needed, with no user interaction. The scope change (S:C) is well justified because the leaked IMAP/SMTP/CalDAV credentials grant access to external mail and calendar systems beyond Twenty itself, and the source-code diff confirms the root cause - ConnectedAccountDTO exposed a password field via the connectedAccounts/myConnectedAccounts queries with no per-user authorization. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and exploitation probability cannot be quantified from the data given; the absence of these signals should not be read as low risk given the trivial exploitability. The main mitigating factor is the PR:L requirement - an attacker must already be a member of the target workspace - making this an insider/compromised-account threat rather than a fully external one. Note the Google and Microsoft tags are potentially misleading: the description explicitly states Google and Microsoft OAuth-only workspaces are NOT affected, so these tags may cause incorrect scoping.

A low-privileged member of a Twenty workspace (e.g., a sales rep or a recently invited user) issues the /metadata GraphQL connectedAccounts query and receives the plaintext IMAP, SMTP, and CalDAV passwords of every colleague who connected a non-OAuth mail or calendar account. The attacker then logs into those external mail/calendar services directly and can read correspondence or attempt password resets on third-party accounts tied to those mailboxes. No public exploit was identified at time of analysis, but the attack requires only a standard GraphQL request and no special tooling.