CVE-2026-105763: Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Twentyto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any normal member of an affected Twenty workspace can exploit it. The attacker does not need administrator privileges or user interaction, but must be able to query the workspace's /metadata GraphQL endpoint.
Which deployments are affected?
Affected deployments are Twenty versions from 1.20.10 up to, but not including, 2.7.0 where connected accounts use plaintext IMAP, SMTP, or CalDAV credentials. Workspaces using only Google or Microsoft OAuth-connected accounts are not affected.
What can an attacker obtain and do with the disclosed data?
An attacker can retrieve plaintext passwords for other workspace members' external mail or calendar connections. Those credentials may allow access to mail or calendars and could potentially be used to reset third-party accounts.
What should be done if upgrading cannot happen immediately?
The provided information identifies version 2.7.0 as the fix. If an affected deployment cannot be upgraded immediately, the available data does not provide a product-level workaround; treat stored IMAP, SMTP, and CalDAV credentials as exposed and rotate them as appropriate.
How can I determine whether credentials may already be exposed?
Assess whether the deployment ran an affected version and had IMAP, SMTP, or CalDAV connected accounts in workspaces with multiple members. The vulnerability allowed any workspace member to retrieve connection parameters for every connected account in that workspace.