CVE-2026-27023 Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client

Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs e.g., webhook endpoints, image URLs could bypass...

Twenty CRM 代码问题漏洞

Twenty CRM is an open-source customer relationship management system developed by Twenty. Versions of Twenty CRM prior to version 1.18 contained code vulnerabilities. These vulnerabilities stemmed from an SSRF protection mechanism that did not validate redirect targets, allowing authenticated use...

PT-2026-23479

Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs e.g., webhook endpoints, image URLs could bypass...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

EUVD-2026-9194

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

CVE-2026-26720

Twenty CRM versions prior to 1.15.0 are affected by CVE-2026-26720, with the root cause in the local.driver.ts module allowing a remote attacker to execute arbitrary code. Affected product: Twenty CRM (v1.15.0 and earlier). Impact is high/critical per CVSS, including potential full compromise. Re...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

Twenty CRM 安全漏洞

Twenty CRM is an open-source customer relationship management system developed by Twenty. Versions of Twenty CRM 1.15.0 and earlier contain security vulnerabilities. These vulnerabilities stem from defects in the local.driver.ts module, which may allow remote attackers to execute arbitrary code...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

PT-2026-22614

Name of the Vulnerable Software and Affected Versions Twenty CRM versions prior to 1.15.0 Description An issue exists in Twenty CRM that allows a remote attacker to execute arbitrary code via the local.driver.ts module. Recommendations Update to a version later than 1.15.0...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

CVE-2026-3265

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The...

EUVD-2026-8925

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The...

CVE-2026-3265

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The...

CVE-2026-3265

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The...

CVE-2026-3264

A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. Executing a manipulation can lead to execution after redirect. The attack can be executed remotely...

CVE-2026-3264

A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. Executing a manipulation can lead to execution after redirect. The attack can be executed remotely...

CVE-2026-3265

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The...