Twenty CRM: Plaintext mail and calendar password disclosure to workspace members
Summary
Twenty, an open-source CRM platform, returned connected account parameters through the /metadata GraphQL connectedAccounts query, including plaintext IMAP, SMTP and CalDAV passwords for every connected account in a workspace. Any authenticated workspace member could read other members' credentials and use them to access mail or calendars, and potentially reset third-party accounts. Workspaces using only Google or Microsoft OAuth were not affected.
Affected
- Twenty from 1.20.10 up to, but not including, 2.7.0
- Only workspaces that store IMAP, SMTP or CalDAV passwords are affected
- Google and Microsoft OAuth-only workspaces are not affected
Fixed in
- Fixed in Twenty 2.7.0
- The 2.7.0 release includes a breaking change: connection parameters are now encrypted and require an ENCRYPTION_KEY to be configured
Workaround
- No workaround is documented by the vendor; upgrading to 2.7.0 is the fix
- Restricting network access to trusted IP ranges reduces exposure but is not a fix
Exploitation
- Automatable: no (CISA SSVC)
- Exploitation: none known; no public proof of concept or CISA KEV listing found
- Unknown whether exploitation has occurred
Our recommendation
- Upgrade all Twenty instances to 2.7.0 or later; plan a maintenance window and back up the database first, as the release includes a migration
- Rotate all IMAP, SMTP and CalDAV passwords stored in Twenty at the mail provider, and revoke app-specific passwords
- Review which users have accounts, remove former staff or contractors, and check logs for unusual access to connected accounts
- Restrict network exposure of the instance where possible
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mq5c-qp77-2cv3 github.com
- Fix commit 57f13c9 github.com
- Fix pull request #20673 github.com
- OSV CVE-2026-105763 osv.dev
- CNA range data (threatint) cve.threatint.com
- Release v2.7.0 (newreleases mirror) newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:25.
Original description (NVD)
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.