CVE-2026-27023: Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client
Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27023?
CVE-2026-27023 is rated as a high severity vulnerability due to its potential for SSRF attacks.
How do I fix CVE-2026-27023?
To fix CVE-2026-27023, update your Twenty CRM installation to version 1.18 or later.
Who is affected by CVE-2026-27023?
CVE-2026-27023 affects users of Twenty CRM versions prior to 1.18 who utilize the SecureHttpClientService.
What does CVE-2026-27023 exploit?
CVE-2026-27023 exploits the lack of validation for redirect targets in the SSRF protection mechanism.
Can CVE-2026-27023 be exploited remotely?
Yes, CVE-2026-27023 can be exploited by authenticated users who can send crafted HTTP requests to the vulnerable service.