CVE-2026-55583: Twenty CRM Auth Bypass Vulnerability

CVE-2026-55583 Overview

CVE-2026-55583 is an Insecure Direct Object Reference (IDOR) vulnerability in Twenty, an open-source customer relationship management (CRM) platform. The flaw resides in the AI agent monitor's AgentTurnResolver and allows authenticated users to access AI chat data belonging to other workspaces on the same instance. The agentTurns(agentId) query and evaluateAgentTurn(turnId) mutation filter database rows by identifier only, omitting workspaceId from the WHERE clause. Versions prior to 2.9.0 are affected, and the issue is patched in 2.9.0.

Critical Impact
Any authenticated user with the AI settings flag can exfiltrate full AI chat histories, including raw chat text, tool calls, and tool outputs, from other workspaces on the same Twenty instance.

Affected Products

Twenty CRM versions prior to 2.9.0
packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/resolvers/agent-turn.resolver.ts
agent-turn-grader.service.ts

Discovery Timeline

2026-06-24 - CVE-2026-55583 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-55583

Vulnerability Analysis

The vulnerability is a cross-workspace Insecure Direct Object Reference [CWE-639] in Twenty's AI agent monitor. The AgentTurnEntity table includes a workspaceId column intended to scope records to their owning tenant. However, the resolver methods agentTurns(agentId) and evaluateAgentTurn(turnId) query rows using only agentId or id as filter criteria. The class-level guards verify that the caller is authenticated in some workspace but do not validate that the requested object belongs to the caller's workspace. The same defect appears in agent-turn-grader.service.ts.

Exploitation yields two impacts. First, agentTurns returns the victim workspace's complete AI chat history, including message parts containing raw chat text, tool calls, and tool outputs. Second, evaluateAgentTurn inserts an agentTurnEvaluation row tagged with the victim's workspaceId and submits the victim's turn to the default large language model (LLM), potentially leaking content downstream.

Root Cause

The root cause is missing tenant isolation in the data access layer. Query builders filter exclusively on the object identifier and ignore the workspaceId column that exists specifically to enforce multi-tenant boundaries. The authentication middleware confirms session validity but does not bind authorization to the requested resource's workspace.

Attack Vector

An attacker authenticated to any workspace on a shared Twenty instance, with the AI settings flag enabled (the default for workspace owners), supplies a victim's agentId or turnId to the GraphQL endpoint. While these identifiers are non-guessable UUIDs, they are exposed in the URL of the AI settings page and can be obtained through shared links, browser history, logs, or social engineering. Refer to the GitHub Security Advisory GHSA-v39r-w5vg-j9pp for full technical details.

Detection Methods for CVE-2026-55583

Indicators of Compromise

GraphQL requests to agentTurns or evaluateAgentTurn where the resolved record's workspaceId does not match the authenticated session's workspace.
Unexpected agentTurnEvaluation rows whose workspaceId differs from the user who triggered creation.
Spikes in calls to the AI agent monitor endpoints from accounts that do not normally use AI features.

Detection Strategies

Audit application logs for cross-tenant identifier usage in agentTurns and evaluateAgentTurn operations.
Add server-side telemetry that compares the session workspaceId to the workspaceId of every returned AgentTurnEntity row.
Review LLM provider logs for prompts containing chat content not originating from the invoking workspace.

Monitoring Recommendations

Forward Twenty server access logs and GraphQL query logs to a centralized SIEM for retention and correlation.
Alert on authentication events from workspace owners who enable the AI settings flag outside expected onboarding windows.
Monitor database queries against AgentTurnEntity and agentTurnEvaluation for missing workspaceId predicates during code review.

How to Mitigate CVE-2026-55583

Immediate Actions Required

Upgrade all Twenty CRM deployments to version 2.9.0 or later without delay.
Rotate any AI agent UUIDs that may have been exposed in shared URLs or screenshots.
Review agentTurnEvaluation records for entries inserted by users outside the owning workspace.

Patch Information

The issue is fixed in Twenty version 2.9.0. The patch adds workspaceId to the WHERE clauses of the affected queries and tightens authorization checks in AgentTurnResolver and agent-turn-grader.service.ts. See the GitHub Security Advisory for the official remediation details.

Workarounds

Restrict the AI settings flag to a minimal set of trusted users until the upgrade is complete.
Operate single-tenant Twenty instances per customer when feasible to remove cross-workspace exposure.
Place the Twenty GraphQL endpoint behind a reverse proxy that logs all agentTurns and evaluateAgentTurn operations for review.

bash

# Upgrade Twenty CRM to the patched release
git fetch --tags
git checkout v2.9.0
npm install
npm run build
npm run start