Is CVE-2026-105763 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105763 being exploited in the wild.

How severe is CVE-2026-105763?

Critical severity, with a CVSS score of 9.6, published 6 October 2026.

Is there a fix for CVE-2026-105763?

Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105763 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105763?

Check whether you run Twenty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105763: Twenty CRM credential disclosure in GraphQL metadata query

CVE-2026-105763 · Severity: critical · CVSS 9.6 · Published 2026-10-06

Twenty is an open-source CRM platform used for managing customer relationships and communications. A vulnerability in versions 1.20.10 to 2.6.x allowed workspace members to retrieve plaintext passwords and credentials for connected external services—such as email and calendar accounts—belonging to other users in the same workspace. An attacker with basic workspace access could use these credentials to access other users' email, calendars, and potentially take over their third-party accounts.

Technologies: Twenty. Vendors: Twenty.

Quick answers

Is CVE-2026-105763 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105763 being exploited in the wild.
How severe is CVE-2026-105763?: Critical severity, with a CVSS score of 9.6, published 6 October 2026.
Which products and versions are affected?: Twenty 1.20.10 to 2.6.x.
Is there a fix for CVE-2026-105763?: Yes: fixed in 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105763 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105763?: Check whether you run Twenty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Technical details

The /metadata GraphQL query's connectedAccounts endpoint returned plaintext connectionParameters including IMAP, SMTP, and CalDAV passwords without enforcing ownership validation or hiding sensitive fields. Any authenticated workspace member could enumerate other users' connected accounts and extract their external-service credentials via an unauthenticated or authorization-bypass GraphQL query. The fix (version 2.7.0) encrypts connectionParameters in the database and removes passwords from all DTO responses.

Affected products

Twenty Twenty 1.20.10 to 2.6.x

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.