CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +195 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (12.0.0-alpha-20260811213401-1eff5799faeb287f78dcafd6415e2afe144cee07)

@graphql-tools/utils NPM version 12.0.0-alpha-20260811213401-1eff5799faeb287f78dcafd6415e2afe144cee07 is affected by a known vulnerability. The following packages have a transitive dependency on @graphql-tools/utils and may be impacted: - @adamwdennis/nestjs-typeorm-cursor-pagination 1.0.0 -...

GHSA-7MX3-VVMW-HJMV GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

EUVD-2026-92849

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-104852

The GraphQL Tools utils package is vulnerable to prototype pollution in the mergeDeep function prior to version 12.0.1 . The root cause is that the function follows inherited properties and fails to exclude __proto__, constructor, or prototype keys during recursive merging. An unauthenticated Gra...

CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-105632

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632

The open-source project management tool Plane is vulnerable to a broken access control flaw in versions prior to 1.4.0 . The GraphQL joinProject mutation allows any workspace member to add themselves to any project within that workspace, including private/secret projects (network=0 ) to which the...

EUVD-2026-92546

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

gitlab-cve-2026-19478-lab

CVE-2026-19478 — GitLab GraphQL @glintroduced 인증 없는 임의 메서드 호출 검증 랩 + PoC CVE-2026-19478GitLab CE/EE, CVSS 9.4, Critical에 대한 재현 가능한 A/B 랩 및 안전한 PoC. 인증되지 않은 공격자는 GraphQL로 해석된 도메인 객체에서 임의의 0-인자 Ruby 메서드를 호출할 수 있습니다 — 예: Projectdestroy를 호출하여 자격 증명 없이 공개 프로젝트를 삭제. 동일 릴리스에서 수정된 관련 CVE-2026-19650GraphQ...