Home

Description

Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18.

PUBLISHED Reserved 2026-02-17 | Published 2026-03-05 | Updated 2026-03-06 | Assigner GitHub_M




MEDIUM: 5.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

Product status

< 1.18
affected

References

github.com/...twenty/security/advisories/GHSA-wm7q-rvq3-x8q9

github.com/twentyhq/twenty/releases/tag/v1.18.0

cve.org (CVE-2026-27023)

nvd.nist.gov (CVE-2026-27023)

Download JSON