CVE-2026-105763

Executive Summary

CVE-2026-105763 is a credential-exposure vulnerability in Twenty, an open-source CRM platform, affecting versions from 1.20.10 up to (but not including) 2.7.0. The /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace—including plaintext IMAP, SMTP, and CalDAV passwords—without enforcing the calling user's identity or account visibility. Any ordinary (low-privileged) workspace member could harvest other members' external-service credentials, earning a CVSS score of 9.6 (C:H/I:H, scope-changed). Google and Microsoft OAuth-only workspaces are not affected.

Technical Analysis

The vulnerability resides in the GraphQL metadata API exposed by Twenty. The /metadata endpoint's connectedAccounts query returned a DTO (ConnectedAccountDTO) that included a connectionParameters field. This field carries the actual authentication secrets used to bind a workspace account to external services: plaintext IMAP, SMTP, and CalDAV passwords.

The root cause is a two-part authorization/design failure:

1. Missing field-level redaction (CWE-522 — Insufficiently Protected Credentials): The connectionParameters field, which contains credentials, was not hidden/redacted before being serialized into the GraphQL response. Secrets intended only for backend connector use were returned to the client verbatim.

2. Missing object-level authorization: The lookup did not enforce the calling user's identity or per-account visibility. A GraphQL query for connected accounts returned records for the entire workspace rather than restricting the result set to accounts the caller owns or is permitted to see.

The combination means the authorization boundary between workspace members is absent for this query: a normal member's authenticated session is sufficient to enumerate every ConnectedAccountDTO in the workspace and read the credentials within connectionParameters.

Attack surface and prerequisites:

• Network-reachable: The endpoint is served by the Twenty application over HTTP(S) (AV:N).
• Low privileges required: A valid, low-privileged workspace member account is sufficient (PR:L). No admin role is needed.
• No user interaction: The attacker drives the query themselves (UI:N).
• Scope change (S:C): Because harvested credentials unlock resources outside Twenty's authorization scope—third-party mail and calendar systems—the impact crosses a security boundary, which is why the vector is scope-changed and scores 9.6 despite no direct impact to the CRM's own data availability (A:N).

Credential exposure here is not merely a confidentiality issue. Valid IMAP/SMTP/CalDAV passwords are directly reusable authentication material against external providers, so the same flaw also enables integrity impact (I:H): an attacker can send mail as the victim, modify or delete calendar entries, and—per the NVD description—potentially reset third-party accounts.

Affected scope is bounded: the query only returned credentials that were stored in connectionParameters. Workspaces where Google or Microsoft OAuth was the only connection method stored no such plaintext passwords in that field, so those workspaces were not affected. Workspaces using IMAP/SMTP/CalDAV connectors were affected.

Fixed in 2.7.0. No public PoC, exploit code, or Nuclei template is known, and no CISA KEV entry exists. Patch confidence is 0/4 in tracked sources—no patch evidence was recorded from the tracked feeds—even though the NVD description states the issue is fixed in 2.7.0. Operators should treat 2.7.0 as the remediation target regardless.

Exploitation Scenarios

No public PoC is available, so the following chain is inferred at the vulnerability-class level from the NVD description. It uses only the endpoint and field names given in that description.

1. Reconnaissance / target identification. The attacker identifies a Twenty instance (versions 1.20.10 through 2.6.x) and obtains a normal, low-privileged workspace membership. This is a modest precondition—any invited teammate, contractor, or compromised low-privilege session qualifies. No administrative access is required.

2. Triggering the flaw. Authenticated as a normal member, the attacker issues a GraphQL request to the /metadata endpoint invoking the connectedAccounts query. Because the query's lookup did not enforce the caller's identity or account visibility, the response includes ConnectedAccountDTO records for every connected account in the workspace—not just the caller's. Each record includes the connectionParameters field, which was not hidden.

3. Credential extraction (payload level). The response body directly contains the plaintext IMAP, SMTP, and CalDAV passwords for other members' connected accounts. No exploitation primitive (no injection, no memory corruption, no brute force) is needed—the secrets are returned by a legitimate API response to an authorized-but-under-privileged caller. The attacker simply parses the response.

4. Post-exploitation. With harvested IMAP/SMTP/CalDAV credentials, the attacker can:

   • Read, send, and delete email via the victims' IMAP/SMTP accounts (impersonation, business email compromise).
   • Access and modify calendars via CalDAV (meeting manipulation, intelligence on schedules).
   • Attempt third-party account resets where the email account is the recovery channel—the NVD description explicitly notes credentials could "potentially reset third-party accounts."

The plaintext nature of the stored passwords means no cracking or offline work is required; the credentials are immediately usable against the upstream providers.

Impact Assessment

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N — 9.6 Critical.

• Confidentiality (C:H): Plaintext credentials for external mail and calendar services are disclosed to any workspace member. This is total compromise of those external secrets as held by Twenty.
• Integrity (I:H): Valid interactive credentials to IMAP/SMTP/CalDAV grant write access—sending mail as the victim, altering or deleting calendar data, and credential-recovery abuse that can cascade into third-party account takeover.
• Availability (A:N): The flaw itself does not directly degrade availability of the CRM or the external services, hence no availability rating.
• Scope (S:C): The vulnerable component (Twenty's metadata API) exposes secrets that grant authority over separate security authorities (external mail/calendar providers), crossing an authorization boundary.
• Attack complexity (AC:L): A single API query, no race conditions or special conditions.
• Privileges (PR:L): Any authenticated workspace member.

Blast radius: Every non-OAuth connected account in a workspace using IMAP/SMTP/CalDAV connectors. Because the flaw leaks all connections in the workspace to any member, a single low-privileged insider or a compromised low-privilege session can harvest the entire workspace's external credentials. Downstream impact extends beyond the CRM to the victim organization's email and calendar estate—classic lateral movement into business communications. OAuth-only Google/Microsoft workspaces are explicitly out of scope.

Business impact: Business email compromise, calendar/scheduling manipulation, phishing from trusted mailboxes, and account-recovery abuse. Organizations running self-hosted or SaaS Twenty with password-based mail/calendar connectors should treat this as an active credential-leak condition.

Detection Guidance

Sigma Rule

title: Twenty CRM ConnectedAccounts Credential Harvesting via Metadata GraphQL
id: 8f2c1a44-7b9e-4d3a-9c11-2e5f0a6d1b77
status: experimental
description: Detects GraphQL requests to Twenty /metadata endpoint invoking the connectedAccounts query, which may indicate exploitation of CVE-2026-105763 to harvest IMAP/SMTP/CalDAV credentials.
author: valtersit.com
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105763
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/metadata'
  selection_body:
    - 'connectedAccounts'
    - 'connectionParameters'
  condition: selection_method and selection_uri and selection_body
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - cs-username
falsepositives:
  - Legitimate frontend UI loading of connected-account metadata by the account owner.
level: high

YARA Rule

rule CVE_2026_105763_Twenty_ConnectedAccounts_Credential_Leak
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP responses/GraphQL payloads referencing Twenty connectedAccounts connectionParameters in a way consistent with CVE-2026-105763 credential exposure"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105763"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ep1 = "/metadata" ascii wide
        $q1 = "connectedAccounts" ascii wide
        $f1 = "connectionParameters" ascii wide
        $pw1 = "imap" ascii nocase
        $pw2 = "smtp" ascii nocase
        $pw3 = "caldav" ascii nocase
        $pw4 = "password" ascii nocase

    condition:
        uint16(0) == 0x4854 and
        $ep1 and $q1 and $f1 and (1 of ($pw*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105763 Twenty CRM connectedAccounts credential harvesting via /metadata GraphQL"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/metadata"; http.request_body; content:"connectedAccounts"; http.request_body; content:"connectionParameters"; classtype:attempted-user; reference:cve,2026-105763; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105763; sid:2026105763; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and
      http.request.body.content : "*connectedAccounts*" ]
  [ network where network.protocol == "http" and http.request.method == "POST" and
      http.request.body.content : "*connectionParameters*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| search method=POST uri_path="*/metadata*"
| search form_data="*connectedAccounts*" OR form_data="*connectionParameters*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths
        by src_ip, user, host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="twenty_crm,credential_exposure,">
  <rule id="105763" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST</match>
    <regex offset="after_regex">/metadata</regex>
    <regex>connectedAccounts</regex>
    <description>CVE-2026-105763: Twenty CRM /metadata connectedAccounts GraphQL query - possible IMAP/SMTP/CalDAV credential harvesting attempt.</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_105763,credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 2.7.0, but no patch evidence was recorded from tracked sources. Verify the fixed version against the vendor's release notes before relying on it.

1. Immediate mitigations

   • Upgrade Twenty to 2.7.0 or later if operationally possible; treat this as the primary remediation.
   • If immediate upgrade is not feasible: restrict network access to the /metadata GraphQL endpoint (e.g., block from untrusted networks, require additional auth at the proxy/WAF layer), and add WAF rules blocking queries containing connectedAccounts/connectionParameters from non-admin contexts. Because no patch evidence was tracked, confirm the fix version with the vendor before assuming any version is clean.
   • Rotate all externally stored credentials now. Any workspace member may already have read the IMAP, SMTP, and CalDAV passwords. Rotate these passwords at the external providers, not just in Twenty. Assume full compromise of any password-based connector in affected workspaces.
   • Review external-service logs (mail, calendar) for anomalous access, sent items, and recovery/reset events.

2. Patch/upgrade steps

   • Back up the database and configuration.
   • Upgrade Twenty to version 2.7.0 or later.
   • Re-run the connectedAccounts query as a low-privileged member after upgrade to confirm connectionParameters is no longer returned for accounts the caller does not own.
   • After upgrade, re-verify that credential rotation has been completed for all previously exposed connectors.

3. Long-term hardening

   • Enforce field-level redaction so secret-bearing fields (connectionParameters) are never serialized to clients; return only references or masked values.
   • Implement object-level authorization on all GraphQL resolvers, validating caller identity and per-object visibility rather than trusting workspace membership.
   • Prefer OAuth-based connectors (Google/Microsoft) over stored plaintext passwords for IMAP/SMTP/CalDAV where feasible; if passwords must be stored, encrypt at rest and decrypt only in backend connector context.
   • Add automated authorization tests covering cross-user and cross-workspace access to sensitive DTO fields.
   • Monitor and alert on the detection signatures above; log and review all /metadata GraphQL queries that request connected-account data.

References

• NVD — CVE-2026-105763: https://nvd.nist.gov/vuln/detail/CVE-2026-105763
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CWE-522 — Insufficiently Protected Credentials: https://cwe.mitre.org/data/definitions/522.html
• Twenty CRM project repository / release notes (verify the 2.7.0 fix): https://github.com/twentyhq/twenty
• FIRST EPSS (not yet scored as of this report): https://www.first.org/epss/

No public PoC, exploit code, or Nuclei template is available. No CISA KEV entry exists for CVE-2026-105763. No known threat actor campaign or exploit-in-the-wild evidence is associated with this CVE at the time of writing.