CVE-2023-1665

CVE-2023-1665 affects linagora/twake (versions prior to 0.0.0). The root cause is improper restriction of excessive authentication attempts, enabling brute-force login on the login endpoint (example PoC shows repeated login attempts against /internal/services/console/v1/login). Impact is high: po...

CVE-2023-0028

The CVE-2023-0028 entry corresponds to a stored Cross-site Scripting (XSS) vulnerability in the linagora/twake repository, where injected scripts can execute when a user clicks an integration URL. Affected component: the integration URL handling in Twake prior to 2023.Q1.1200+. Root cause: unvali...

CVE-2023-2675

CVE-2023-2675 targets linagora/twake versions prior to 2023.Q1.1223, where there is an improper restriction of excessive authentication attempts. Public assessments indicate high-impact potential (confidentiality, integrity, and availability). The vulnerability is tied to brute-force-like behavio...

CVE-2025-70037

CVE-2025-70037 affects linagora Twake v2023.Q1.1223 and is tied to CWE-601 (URL Redirection to Untrusted Site). The Red Hat, NVD, CIRCL, EUVD, and other connected records confirm the vulnerability and describe the impact as allowing attackers to obtain sensitive information and to execute arbitra...

CVE-2025-70038

CVE-2025-70038 affects linagora Twake v2023.Q1.1223. The issue is CWE-79 (Improper Neutralization of Input During Web Page Generation) enabling arbitrary code execution. Reported across multiple feeds (Red Hat, NVD, CIRCL, ENISA EUVD) with CVSSv3.1 base score 8.8 ( HIGH; AV:N/AC:L/PR:N/UI:R/S:U/C...

CVE-2025-70039

CVE-2025-70039 affects linagora Twake 2023.Q1.1223 with a CWE-78 OS command injection vulnerability. Base CVSS 3.1: 9.8 (_network, no auth, no user interaction, impact high for confidentiality, integrity, and availability). Root cause: improper neutralization of special elements used in an OS com...