Executive brief
Twenty is an open-source Customer Relationship Management (CRM) platform. A security flaw in its AI monitoring component allows an authorized user in one workspace to access sensitive data from other workspaces on the same server. An attacker could view private chat histories, including raw text and tool outputs, or trigger AI evaluations on data belonging to other customers, potentially leading to significant data exposure.
Technical details
A cross-workspace Insecure Direct Object Reference (IDOR) exists in the AgentTurnResolver and agent-turn-grader.service.ts. The root cause is that the agentTurns query and evaluateAgentTurn mutation perform database lookups using only agentId or id without verifying the workspaceId, even though the AgentTurnEntity contains a workspaceId column. While class-level guards ensure a user is authenticated, they fail to verify that the requested object belongs to the user's specific workspace. An attacker with low privileges (authenticated with AI settings access) can retrieve full chat histories or insert evaluation rows for other workspaces if they obtain the victim's non-guessable UUIDs (which may be exposed in URLs). This issue is resolved in version 2.9.0.
Affected products
- twentyhq Twenty < 2.9.0
Timeline
- 2026-06-17: advisory: GitHub advisory published
- 2026-06-24: disclosed: NVD publication date