CVE-2026-55583: Twenty CRM Cross-Workspace IDOR in AI Agent Monitor (CVSS 7.6)

Technical summary

The vulnerability is an insecure direct object reference (IDOR) in Twenty's AI agent monitor, specifically in the AgentTurnResolver and agent-turn-grader service. The agentTurns(agentId) GraphQL query and evaluateAgentTurn(turnId) mutation perform database lookups using only agentId or id parameters, omitting the workspaceId in their WHERE clauses. Although AgentTurnEntity contains a workspaceId column, it is not enforced during retrieval. The class-level authentication guards verify only that a caller is authenticated within some workspace, not that the requested object belongs to that caller's workspace. This allows any authenticated user to craft queries targeting other workspaces' agent IDs or turn IDs—non-guessable UUIDs that are nonetheless exposed in URL parameters on the settings page. Successful exploitation returns sensitive chat histories including raw messages, tool calls, and outputs, and allows insertion of evaluations into a victim's workspace via the default LLM.

Business impact

Organizations using Twenty as their CRM face exposure of confidential customer communications and AI-driven agent interactions. Since the AI agent monitor is available to workspace owners by default, any owner can pivot to access competitors' or other tenants' data on shared instances. Multi-tenant deployments are at highest risk. Compromised chat histories may reveal customer names, conversation context, and business logic, while unauthorized turn evaluations could introduce false or malicious LLM assessments into victim workflows. This undermines tenant isolation and data confidentiality in SaaS deployments.

Affected systems

Twenty CRM versions prior to 2.9.0 are vulnerable. The flaw requires an authenticated user account with the AI settings flag enabled, a privilege that defaults to workspace owners. Multi-tenant instances are more severely affected than single-tenant deployments. The vulnerability does not require special network access; any authenticated user on the same instance can exploit it.

Exploitability

Exploitation is straightforward and requires minimal technical skill. An attacker needs valid credentials in any workspace and the AI settings flag. The attack surface is passive discovery of agentId and turnId via the settings page URL, followed by crafted GraphQL queries. No user interaction is required beyond authentication. The non-guessable nature of UUIDs provides only obfuscation; once IDs are known, access is immediate. The CVSS score of 7.6 (HIGH) reflects the combination of low attack complexity, low privilege requirements relative to the sensitive data exposed, and high confidentiality impact, tempered by limited integrity risk.

Remediation

Upgrade to Twenty version 2.9.0 or later. This version corrects the database queries and authentication guards to enforce workspace membership validation. Ensure that all agentTurns and evaluateAgentTurn operations verify that the caller's workspace matches the target object's workspaceId before returning or modifying data. If immediate patching is not possible, restrict the AI settings flag to a minimal set of trusted users and audit workspace access logs for cross-workspace query attempts.

Patch guidance

Apply the patch in version 2.9.0 by updating your Twenty installation following the vendor's upgrade procedures. Verify that the patched AgentTurnResolver and agent-turn-grader.service.ts files now include workspaceId validation in all database WHERE clauses and that guard checks confirm workspace ownership, not just authentication state. Test the fix by confirming that authenticated users cannot access agentTurns or turns belonging to other workspaces. Consider running a post-patch audit to check logs for suspicious cross-workspace queries prior to the upgrade.

Detection guidance

Monitor GraphQL query logs for repeated or sequential calls to agentTurns or evaluateAgentTurn with agentId or turnId parameters that differ from the caller's own workspace. Look for patterns in which a single user queries multiple distinct agentIds or turnIds belonging to different workspace contexts. Examine access logs for users with the AI settings flag accessing agent data outside their own workspace. Check for unexpected agentTurnEvaluation rows inserted into workspaces where the calling user is not a member. If Twenty logs GraphQL operations, search for calls originating from authenticated sessions that target UUIDs outside the caller's workspace scope.

Why prioritize this

This vulnerability merits high priority because it breaks a foundational trust boundary in multi-tenant systems: workspace isolation. Any authenticated user can exploit it without additional steps, and the exposed data—customer conversations and AI interactions—is business-critical. Organizations running shared Twenty instances should patch immediately. Single-tenant deployments face lower risk but should still update to limit insider threats.

Risk score, explained

The CVSS 3.1 score of 7.6 reflects: (1) Network accessibility (AV:N) — exploitable remotely; (2) Low attack complexity (AC:L) — no special conditions required; (3) Low privilege (PR:L) — any authenticated user can exploit; (4) Required user interaction (UI:R) — the attacker must authenticate, though this is not a protection in multi-tenant environments; (5) Changed scope (S:C) — impact crosses workspace boundaries; (6) High confidentiality (C:H) — full exposure of chat history and agent interactions; (7) Low integrity (I:L) — evaluations can be inserted but core data is not modified; (8) No availability impact (A:N). The HIGH severity is justified by the cross-workspace scope and sensitivity of CRM data.

Frequently asked questions