CVE-2026-27023

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27023", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T03:08:23.490Z", "datePublished": "2026-03-05T16:23:31.020Z", "dateUpdated": "2026-03-06T16:11:48.950Z"}, "containers": {"cna": {"title": "Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/twentyhq/twenty/security/advisories/GHSA-wm7q-rvq3-x8q9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-wm7q-rvq3-x8q9"}, {"name": "https://github.com/twentyhq/twenty/releases/tag/v1.18.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/twentyhq/twenty/releases/tag/v1.18.0"}], "affected": [{"vendor": "twentyhq", "product": "twenty", "versions": [{"version": "< 1.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T16:23:31.020Z"}, "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18."}], "source": {"advisory": "GHSA-wm7q-rvq3-x8q9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T15:50:55.976803Z", "id": "CVE-2026-27023", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:11:48.950Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T15:50:55.976803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:50:56.993Z"}}], "cna": {"title": "Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client", "source": {"advisory": "GHSA-wm7q-rvq3-x8q9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "twentyhq", "product": "twenty", "versions": [{"status": "affected", "version": "< 1.18"}]}], "references": [{"url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-wm7q-rvq3-x8q9", "name": "https://github.com/twentyhq/twenty/security/advisories/GHSA-wm7q-rvq3-x8q9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/twentyhq/twenty/releases/tag/v1.18.0", "name": "https://github.com/twentyhq/twenty/releases/tag/v1.18.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T16:23:31.020Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27023", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:11:48.950Z", "dateReserved": "2026-02-17T03:08:23.490Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T16:23:31.020Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "twenty", "vendor": "twentyhq", "versions": [{"status": "affected", "version": "< 1.18"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:twenty:twenty:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6AA9729-A93E-415A-90FF-A7947F843544", "versionEndExcluding": "1.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18."}, {"lang": "es", "value": "Twenty es un CRM de c\u00f3digo abierto. Antes de la versi\u00f3n 1.18, la protecci\u00f3n SSRF en SecureHttpClientService validaba las URL de solicitud a nivel de solicitud, pero no validaba los objetivos de redirecci\u00f3n. Un usuario autenticado que pod\u00eda controlar las URL de solicitud salientes (por ejemplo, puntos finales de webhook, URL de imagen) pod\u00eda eludir el bloqueo de IP privadas redirigiendo a trav\u00e9s de un servidor controlado por un atacante. Este problema ha sido parcheado en la versi\u00f3n 1.18."}], "id": "CVE-2026-27023", "lastModified": "2026-06-17T10:26:34.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27023", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T15:50:55.976803Z", "version": "2.0.3"}}]}, "published": "2026-03-05T19:16:05.493", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/twentyhq/twenty/releases/tag/v1.18.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/twentyhq/twenty/security/advisories/GHSA-wm7q-rvq3-x8q9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.18)"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "twenty", "source": "cna", "vendor": "twentyhq"}, "product": "twenty", "vendor": "twenty"}], "analysis": {"en": {"generated_at": "2026-04-18T09:53:40.040453+00:00", "value": {"mitigation_remediation": ["Upgrade to Twenty version 1.18 or later to apply the official patch that validates redirect targets", "If upgrading is not immediately possible, reuse configuration or policy controls to eliminate or strictly limit the ability of authenticated users to specify outbound URLs such as webhook endpoints or image locations", "Deploy network-level controls\u2014such as firewall rules or application proxies\u2014to block outgoing connections from the CRM to private IP ranges, providing a secondary defense against SSRF"], "summary": {"action": "Patch immediately", "impact": "SSRF bypass allowing authenticated users to reach internal network resources through redirects"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in every release of the Twenty application before version 1.18. The product is delivered by twentyhq as the \"twenty\" open-source CRM. Upgrading to version 1.18 or later removes the defect by ensuring that redirect targets are also validated against the same URL restrictions.", "description_and_impact": "Twenty is an open-source CRM that, prior to version 1.18, implemented SSRF protection by validating the URLs supplied to its secure HTTP client at the time a request was made. However, the validator did not inspect URLs presented in HTTP redirect responses. An attacker who could influence an outbound request URL\u2014such as configuring a webhook endpoint, an image URL, or any other externally supplied address\u2014could engineer a redirect chain that points to an internal IP address. When the CRM followed the redirect, the request would be sent to the private network, potentially exposing internal services. This flaw is classified as CWE\u2011918 and can compromise confidentiality and integrity of data within the organization.", "risk_and_exploitability": "The CVSS score of 5.0 indicates medium severity, and the EPSS score of less than 1 % suggests a very low likelihood of exploitation at this time. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker obtains authenticated access to the CRM and can set arbitrary outbound URLs, after which the redirect-bypass attack can be carried out remotely with relative ease. Despite the low exploitation probability, the potential to expose internal network resources justifies prompt remediation."}}}}, "created": "2026-03-06T15:01:37.590100+00:00", "updated": "2026-04-18T10:00:10.333940+00:00", "vendors": ["twenty", "twenty$PRODUCT$twenty"]}