CVE-2026-105763: Twenty CRM Information Disclosure Flaw

CVE-2026-105763 Overview

Twenty is an open-source customer relationship management (CRM) platform. A credential exposure flaw in the /metadata GraphQL endpoint allowed any authenticated workspace member to retrieve plaintext IMAP, SMTP, and CalDAV passwords belonging to other members. The connectedAccounts query returned the connectionParameters field from ConnectedAccountDTO without filtering by the calling user's identity or account visibility. Versions from 1.20.10 up to 2.7.0 are affected. Workspaces using only Google or Microsoft OAuth are not impacted. The issue is tracked under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
A low-privileged workspace member can harvest other users' external-service credentials and pivot to their mail accounts, calendars, and potentially reset linked third-party accounts.

Affected Products

Twenty CRM versions 1.20.10 through versions prior to 2.7.0
Self-hosted Twenty deployments using IMAP, SMTP, or CalDAV connected accounts
Workspaces with mixed authentication providers that include non-OAuth mail or calendar connections

Discovery Timeline

2026-10-06 - CVE-2026-105763 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105763

Vulnerability Analysis

The flaw resides in the GraphQL connectedAccounts query exposed under the /metadata schema. The resolver returned the full ConnectedAccountDTO object, including the connectionParameters field containing credential material in plaintext. No access-control filter restricted result rows to the calling user's own accounts. Any authenticated member of a workspace could issue the query and receive every member's connection parameters.

The credential material included IMAP, SMTP, and CalDAV passwords used by Twenty to synchronize mail and calendar data. Because the credentials were stored and returned without encryption at the API boundary, an attacker could directly reuse them against external mail and calendar providers. Password reuse against identity recovery flows could further escalate access to third-party accounts tied to the exposed mailboxes.

Root Cause

Two defects combined to produce the exposure. First, the connectionParameters field on the ConnectedAccount GraphQL type was not hidden from the public schema, so it could be requested in any query. Second, the server-side lookup did not scope the query to the authenticated user, returning records for the entire workspace. The fix in version 2.7.0 encrypts ConnectedAccountconnectionParameters and replaces the shared ImapSmtpCaldavAccount output type with an input-only ImapSmtpCaldavAccountInput, removing the readable field from the GraphQL schema.

Attack Vector

Exploitation requires only a valid workspace account with standard member privileges. The attacker sends a crafted GraphQL query to the /metadata endpoint requesting connectedAccounts { connectionParameters }. The server returns credentials for all connected accounts in the workspace. No user interaction from the victim is required.

typescript

// Patch excerpt - packages/twenty-front/src/modules/accounts/types/ConnectedAccount.ts
 import { type CalendarChannel } from '@/accounts/types/CalendarChannel';
-import { type ImapSmtpCaldavAccount } from '@/accounts/types/ImapSmtpCaldavAccount';
+import { type ImapSmtpCaldavAccountInput } from '@/accounts/types/ImapSmtpCaldavAccountInput';
 import { type ConnectedAccountProvider } from 'twenty-shared/types';
 import { type MessageChannel } from './MessageChannel';

// Patch excerpt - packages/twenty-front/src/modules/accounts/types/ImapSmtpCaldavAccount.ts
-import { type ConnectionParameters } from '~/generated-metadata/graphql';
-
-export type ImapSmtpCaldavAccount = {
-  IMAP?: ConnectionParameters;
-  SMTP?: ConnectionParameters;
-  CALDAV?: ConnectionParameters;
-};

Source: GitHub Commit 57f13c9b

Detection Methods for CVE-2026-105763

Indicators of Compromise

GraphQL requests to the /metadata endpoint containing the connectedAccounts field with a connectionParameters selection set
Unusual outbound IMAP, SMTP, or CalDAV authentication attempts from client IPs that match recent Twenty workspace logins
Access to connected mailboxes from geolocations or user agents inconsistent with the mailbox owner's baseline

Detection Strategies

Enable verbose GraphQL request logging on the Twenty backend and alert on any query that selects the connectionParameters field prior to the upgrade to 2.7.0
Correlate Twenty API access logs with external mail provider authentication logs to identify credential reuse by a different principal
Review audit trails for workspace members who issued broad connectedAccounts queries returning multiple records

Monitoring Recommendations

Forward Twenty application logs and reverse-proxy access logs to a centralized SIEM for retention and query
Monitor external IMAP, SMTP, and CalDAV servers for authentication from new source IPs following the disclosure window
Track GraphQL schema introspection requests from authenticated sessions, which often precede targeted field abuse

How to Mitigate CVE-2026-105763

Immediate Actions Required

Upgrade Twenty to version 2.7.0 or later without delay
Rotate every IMAP, SMTP, and CalDAV password configured as a connected account in affected workspaces
Review workspace membership and revoke access for any accounts that are no longer required
Audit third-party accounts whose password-reset flows depend on the exposed mailboxes and rotate those credentials as well

Patch Information

The vendor released a fix in Twenty 2.7.0. The patch encrypts ConnectedAccountconnectionParameters at rest and removes the readable ImapSmtpCaldavAccount GraphQL output type, replacing it with an input-only variant. Review the GitHub Security Advisory GHSA-mq5c-qp77-2cv3 and Pull Request #20673 for the full change set. Note that the upgrade is a breaking change for the ConnectedAccount schema.

Workarounds

Temporarily disable IMAP, SMTP, and CalDAV connected accounts and rely solely on Google or Microsoft OAuth providers, which are not affected
Restrict network access to the Twenty /metadata GraphQL endpoint using a reverse-proxy allowlist until the upgrade is applied
Reduce workspace membership to trusted administrators while planning the upgrade

bash

# Pin the fixed container image when deploying Twenty
docker pull twentycrm/twenty:2.7.0
docker stop twenty && docker rm twenty
docker run -d --name twenty \
  -e APP_SECRET="$APP_SECRET" \
  -p 3000:3000 \
  twentycrm/twenty:2.7.0