Twenty CVE-2026-26720

The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. Rated high severi

Remote code execution in Twenty CRM versions 1.7.7 through 1.16.7 allows authenticated users to execute arbitrary OS com

The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload. Rated medium severity (CVSS 5.4), this vuln

SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission i

Stored cross-site scripting in Twenty CRM versions 1.18.0 and earlier allows authenticated users to upload HTML/JavaScri

Server-side request forgery (SSRF) in Twenty CRM allows authenticated users to bypass IP filtering protections and acces

Cross-workspace data disclosure in Twenty CRM before 2.9.0 lets any authenticated user holding the AI settings flag (a w

Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious Ja

OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM throu

Twenty CRM versions prior to 1.18 allow authenticated users to bypass SSRF protections by exploiting unvalidated HTTP re