twenty
v2.58.0The open alternative to Salesforce, designed for AI.
- Maintenance
- Active3623 commits in 3 months · bus factor 6
- License
- OtherUnknown
- Security
- 15 advisories3 critical, 3 high, 9 medium
- Supported versions
- No scheduleendoflife.date does not track this project
61k stars · 10.1k forks · 116 open issues · last release 1 day ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 15 most recent advisories published by the maintainers: 3 critical, 3 high, 9 medium. Check the patched version against the one you run.
- mediumGHSA-j86q-q8c2-f8x7Oct 27, 2026Field-level read permission bypass: timelineActivity.properties returns the before/after values of fields the caller's role cannot read
- Affected
- >= 1.4.0, < 2.52.0
- Patched in
- 2.52.0
- mediumGHSA-qf3h-pmgc-fcw6Oct 22, 2026Unauthenticated execution of application logic functions through /webhooks/server
- Affected
- >= 2.16.0, < 2.19.0
- Patched in
- 2.19.0
- mediumGHSA-pg47-7c3r-fwfxOct 22, 2026Open OAuth Dynamic Client Registration enables phishing-based CRM data theft (CWE-287/CWE-862)
- Affected
- <= 0.2.1
- highGHSA-m4vm-35cw-44rqOct 22, 2026Unauthenticated takeover of pending workspace invitations: signUp returns the invitee's personal invite token without proof of email ownership
- Affected
- <= 2.47.0
- mediumGHSA-9pfj-h2fx-29hgOct 19, 2026IMAP and SMTP connected-account connections do not verify the mail server's TLS certificate
- Affected
- < 2.48.0
- Patched in
- 2.48.0
- mediumGHSA-8w82-h3w4-62r5Oct 19, 2026Privilege escalation to workspace Admin via invitation roleId: sendInvitations requires only WORKSPACE_MEMBERS, not the ROLES permission (BFLA)
- Affected
- >= 1.19.0, < 2.47.0
- Patched in
- 2.47.0
- mediumCVE-2026-85055Sep 2, 2026Field-level read bypass via filter predicate (boolean/count oracle)
- Affected
- < 2.22.0
- Patched in
- 2.22.0
- criticalCVE-2026-105763Sep 1, 2026Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
- Affected
- >= 1.20.10, < 2.7.0
- Patched in
- 2.7.0
- criticalCVE-2026-73069Jul 27, 2026SQL Injection in Twenty `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
- Affected
- < 2.15.0
- Patched in
- 2.15.0
- highCVE-2026-55583Jun 17, 2026Cross-workspace IDOR in AgentTurnResolver
- Affected
- <2.9.0
- criticalCVE-2026-46624May 17, 2026SQL Injection on v <=1.16.7
- Affected
- <=1.16.7
- Patched in
- 1.16.7
- highCVE-2026-44729May 5, 2026Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
- Affected
- 1.18.0
- Patched in
- 1.19.0
- mediumCVE-2026-33975Apr 27, 2026SSRF protection bypass via IPv4-mapped IPv6 address normalization in twenty-server
- Affected
- <= 1.18.0
- mediumCVE-2026-35451Apr 21, 2026Stored XSS via BlockNote FileBlock
- Affected
- 1.19.0
- mediumCVE-2026-27023Mar 4, 2026SSRF protection bypass via HTTP redirect following in secure HTTP client
- Affected
- <=1.17
- Patched in
- 1.18