A defect in the /metadata GraphQL endpoint of the Twenty CRM allows any workspace member to retrieve connection parameters for every connected account in the workspace, including plaintext IMAP, SMTP, and CalDAV passwords. The field was not hidden and the query did not enforce identity or visibility checks, so users could harvest another member’s external-service credentials. With those credentials, an attacker could log into the third‑party account, read or modify mail and calendar data, and potentially reset the account on the service provider’s platform.

The vulnerability affects the open‑source Twenty CRM product from version 1.20.10 through 2.7.0. Versions 2.7.0 and later contain a fix, and OAuth‑only workspaces are not impacted.

The CVSS score of 9.6 indicates a critical threat, and there are no restrictions on the attacker's access: any normal workspace member can exploit the flaw. While no exploit score is available and the issue is not listed in the CISA KEV catalog, the exposed passwords represent a severe breach of confidentiality and a significant risk of unauthorized third‑party access. The vulnerability is directly exploitable without the need for additional preconditions beyond membership in the workspace.