CVE-2026-55583: CWE-639: Authorization Bypass Through User-Controlled Key in twentyhq twenty
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId and turnId are non-guessable UUIDs but are exposed in the URL of the settings page. This issue is fixed in version 2.9.0.
AI Analysis
Technical Summary
CVE-2026-55583 is an authorization bypass vulnerability in the twentyhq 'twenty' CRM platform before version 2.9.0. The issue arises from missing workspace ownership checks in the AI agent monitor's AgentTurnResolver and related services. The agentTurns(agentId) query and evaluateAgentTurn(turnId) mutation only filtered by agentId or turnId without verifying the workspaceId, allowing an authenticated user with the AI settings flag to access or modify agent turn data across different workspaces on the same instance. Although agentId and turnId are UUIDs, they are exposed in URLs, facilitating targeted exploitation. This leads to unauthorized disclosure of full chat histories and unauthorized insertion of evaluation data tied to victim workspaces. The vulnerability is addressed by adding proper workspace ownership checks in version 2.9.0.
Potential Impact
An attacker who is authenticated and has the AI settings flag (default for workspace owners) can access sensitive chat histories and related data from other workspaces on the same instance, violating data confidentiality. They can also insert evaluation records into victim workspaces, potentially affecting data integrity. The vulnerability does not impact availability. The CVSS 3.1 base score is 7.6 (high), reflecting network attack vector, low attack complexity, privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
A fix is available in twenty version 2.9.0 that adds proper workspace ownership verification to the affected queries and mutations. Users should upgrade to version 2.9.0 or later to remediate this vulnerability. No vendor advisory is provided, but the fix is explicitly stated in the description. Until upgrading, restrict AI settings access to trusted users only.
CVE-2026-55583: CWE-639: Authorization Bypass Through User-Controlled Key in twentyhq twenty
Description
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId and turnId are non-guessable UUIDs but are exposed in the URL of the settings page. This issue is fixed in version 2.9.0.
CVSS v3.1
Score 7.6high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55583 is an authorization bypass vulnerability in the twentyhq 'twenty' CRM platform before version 2.9.0. The issue arises from missing workspace ownership checks in the AI agent monitor's AgentTurnResolver and related services. The agentTurns(agentId) query and evaluateAgentTurn(turnId) mutation only filtered by agentId or turnId without verifying the workspaceId, allowing an authenticated user with the AI settings flag to access or modify agent turn data across different workspaces on the same instance. Although agentId and turnId are UUIDs, they are exposed in URLs, facilitating targeted exploitation. This leads to unauthorized disclosure of full chat histories and unauthorized insertion of evaluation data tied to victim workspaces. The vulnerability is addressed by adding proper workspace ownership checks in version 2.9.0.
Potential Impact
An attacker who is authenticated and has the AI settings flag (default for workspace owners) can access sensitive chat histories and related data from other workspaces on the same instance, violating data confidentiality. They can also insert evaluation records into victim workspaces, potentially affecting data integrity. The vulnerability does not impact availability. The CVSS 3.1 base score is 7.6 (high), reflecting network attack vector, low attack complexity, privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
A fix is available in twenty version 2.9.0 that adds proper workspace ownership verification to the affected queries and mutations. Users should upgrade to version 2.9.0 or later to remediate this vulnerability. No vendor advisory is provided, but the fix is explicitly stated in the description. Until upgrading, restrict AI settings access to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T23:18:03.169Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3c3685e60265867b7394f3
Added to database: 06/24/2026, 19:56:53 UTC
Last enriched: 07/01/2026, 22:39:06 UTC
Last updated: 08/08/2026, 16:24:12 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.