CVE-2026-55583
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedTwenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation looked up rows by agentId or id only; although AgentTurnEntity has a workspaceId column, it was not included in the WHERE clause, and the class-level guards only checked that the caller was authenticated in some workspace rather than that the requested object belonged to it, with the same flaw present in agent-turn-grader.service.ts. As a result, any authenticated user with the AI settings flag, a workspace owner by default, could target any other workspace on the same instance given the victim's agentId or turnId: agentTurns returned the victim's full chat history including message parts such as raw chat text, tool calls, and tool outputs, while evaluateAgentTurn inserted an agentTurnEvaluation row with the victim's workspaceId and fed the victim's turn into the default LLM. The agentId and turnId are non-guessable UUIDs but are exposed in the URL of the settings page. This issue is fixed in version 2.9.0.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceTwenty CRM versions before 2.9.0 contain an IDOR vulnerability in the AI agent monitor's AgentTurnResolver. The agentTurns query and evaluateAgentTurn mutation failed to validate that the requested agentId/turnId belonged to the caller's workspace—only checking authentication existence rather than ownership—allowing any authenticated user to access arbitrary workspace AI agent data by knowing the exposed UUIDs.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Twenty CRM installationCheck for Twenty CRM by looking for the application in your installed packages, container images, or running processes. Common indicators include the 'twenty' package name or process, or the presence of Twenty-specific configuration files in your deployment.Affected if Twenty CRM is not installed - not vulnerable
-
Determine installed versionRun `npm list twentycrm` or check your package-lock.json/pnpm-lock.yaml for the twenty package version. If deployed as a Docker container, check the image tag or inspect the container metadata.Affected if Version is 2.9.0 or later - not vulnerable; version is before 2.9.0 or cannot be determined - potentially vulnerable
-
Verify AI agent monitor is accessibleCheck if the GraphQL schema exposes agentTurns query and evaluateAgentTurn mutation. This can be done by introspecting the GraphQL endpoint or examining the schema files in the codebase for these operations.Affected if These operations exist in your schema and are accessible to authenticated users - vulnerable to IDOR
-
Check authentication without ownership validationExamine the AgentTurnResolver file in your codebase (typically in server/src/core/ai/agent-turn-resolver.ts or similar path). Look for whether the resolver checks workspaceId ownership or only verifies user authentication exists.Affected if Resolver only checks authentication (user is logged in) but does not validate that the requested agentId/turnId belongs to the caller's workspace - vulnerable
You are affected if you run Twenty CRM version before 2.9.0 and the AI agent monitor GraphQL operations (agentTurns query or evaluateAgentTurn mutation) are accessible to authenticated users without workspace ownership validation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to Twenty version 2.9.0 or later, which includes proper workspaceId validation in the affected resolver and service files.
2.9.0
- 1. Identify the currently installed version of Twenty by checking the package.json or running a version command in the deployment environment
- 2. Upgrade Twenty to version 2.9.0 or later by updating the package version and running the appropriate update command (e.g., npm update, docker pull, or your deployment mechanism)
- 3. Verify the upgrade was successful by confirming the new version is running
- 4. Test that workspace isolation is functioning correctly by attempting to access resources from a different workspace (this should fail post-upgrade)
- 5. Review AI agent settings to ensure only authorized users have access to the AI settings feature
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation6.0 h
- Testing4.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,512.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-55583 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-55583 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data