Vulnerability · Published Mar 5, 2026 · Assigned by GitHub_M

CVE-2026-27023Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client

Medium 5.0

In plain English

A medium-severity server-side request forgery in twenty from twentyhq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 85.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not validate redirect targets. An authenticated user who could control outbound request URLs (e.g., webhook endpoints, image URLs) could bypass private IP blocking by redirecting through an attacker-controlled server. This issue has been patched in version 1.18.

Affected products (as reported)

Vendor	Product	Versions
twentyhq	twenty	< 1.18

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/twentyhq/twenty/security/advisories/GHSA-wm7q-rvq3-x8q9 x_refsource_CONFIRM
https://github.com/twentyhq/twenty/releases/tag/v1.18.0 x_refsource_MISC