Twenty is an open-source CRM that, prior to version 1.18, implemented SSRF protection by validating the URLs supplied to its secure HTTP client at the time a request was made. However, the validator did not inspect URLs presented in HTTP redirect responses. An attacker who could influence an outbound request URL—such as configuring a webhook endpoint, an image URL, or any other externally supplied address—could engineer a redirect chain that points to an internal IP address. When the CRM followed the redirect, the request would be sent to the private network, potentially exposing internal services. This flaw is classified as CWE‑918 and can compromise confidentiality and integrity of data within the organization.

The vulnerability exists in every release of the Twenty application before version 1.18. The product is delivered by twentyhq as the "twenty" open-source CRM. Upgrading to version 1.18 or later removes the defect by ensuring that redirect targets are also validated against the same URL restrictions.

The CVSS score of 5.0 indicates medium severity, and the EPSS score of less than 1 % suggests a very low likelihood of exploitation at this time. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker obtains authenticated access to the CRM and can set arbitrary outbound URLs, after which the redirect-bypass attack can be carried out remotely with relative ease. Despite the low exploitation probability, the potential to expose internal network resources justifies prompt remediation.