CyberRota Analysis
AI-GeneratedThe vulnerability affects the Twenty open-source CRM platform, where the /metadata GraphQL connectedAccounts query improperly exposes plaintext credentials, including IMAP, SMTP, and CalDAV passwords, for all connected accounts within a workspace. This critical flaw allows unauthorized users to access sensitive external-service credentials, potentially compromising email and calendar accounts of other members. Organizations using versions 1.20.10 to 2.6.0 should prioritize upgrading to version 2.7.0 to mitigate the risk of credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.