CVE-2026-55583: CWE-639: Authorization Bypass Through User-Controlled Key in twentyhq twenty
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId and turnId are non-guessable UUIDs but are exposed in the URL of the settings page. This issue is fixed in version 2.9.0.
AI Analysis
Technical Summary
CVE-2026-55583 describes an authorization bypass vulnerability (CWE-639) in the twentyhq twenty CRM platform before version 2.9.0. The AI agent monitor's AgentTurnResolver component failed to include workspaceId in its data lookup queries (agentTurns and evaluateAgentTurn), allowing authenticated users with the AI settings flag to access or modify data belonging to other workspaces on the same instance. The agentId and turnId parameters, though UUIDs, were exposed in URLs, enabling cross-workspace access to sensitive chat histories and the ability to insert agent turn evaluations under another workspace's identity. This vulnerability was resolved in version 2.9.0 by correcting the query filters and authorization checks.
Potential Impact
An attacker who is authenticated and has the AI settings flag (default for workspace owners) can access full chat histories and related data from other workspaces on the same instance, violating data confidentiality. They can also insert evaluation records associated with other workspaces, potentially affecting data integrity. The vulnerability does not affect availability. The CVSS 3.1 score is 7.6 (High), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
A fix is available in twenty version 2.9.0 that addresses this authorization bypass by including workspaceId in query filters and strengthening class-level guards. Users should upgrade to version 2.9.0 or later to remediate this vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.
CVE-2026-55583: CWE-639: Authorization Bypass Through User-Controlled Key in twentyhq twenty
Description
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId and turnId are non-guessable UUIDs but are exposed in the URL of the settings page. This issue is fixed in version 2.9.0.
CVSS v3.1
Score 7.6high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55583 describes an authorization bypass vulnerability (CWE-639) in the twentyhq twenty CRM platform before version 2.9.0. The AI agent monitor's AgentTurnResolver component failed to include workspaceId in its data lookup queries (agentTurns and evaluateAgentTurn), allowing authenticated users with the AI settings flag to access or modify data belonging to other workspaces on the same instance. The agentId and turnId parameters, though UUIDs, were exposed in URLs, enabling cross-workspace access to sensitive chat histories and the ability to insert agent turn evaluations under another workspace's identity. This vulnerability was resolved in version 2.9.0 by correcting the query filters and authorization checks.
Potential Impact
An attacker who is authenticated and has the AI settings flag (default for workspace owners) can access full chat histories and related data from other workspaces on the same instance, violating data confidentiality. They can also insert evaluation records associated with other workspaces, potentially affecting data integrity. The vulnerability does not affect availability. The CVSS 3.1 score is 7.6 (High), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
A fix is available in twenty version 2.9.0 that addresses this authorization bypass by including workspaceId in query filters and strengthening class-level guards. Users should upgrade to version 2.9.0 or later to remediate this vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T23:18:03.169Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3c3685e60265867b7394f3
Added to database: 06/24/2026, 19:56:53 UTC
Last enriched: 06/24/2026, 20:01:25 UTC
Last updated: 06/24/2026, 20:49:45 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.