Twenty, an open‑source CRM platform, contained a cross‑workspace Insecure Direct Object Reference (CWE‑639) in the AI agent monitor’s AgentTurnResolver. The agentTurns query and evaluateAgentTurn mutation retrieved agent turns only by agentId or turnId, ignoring the workspaceId column. Thus, any authenticated user with the AI settings flag—normally reserved for workspace owners—could request another workspace’s agent turns. The payload included full chat history, message parts, and tool outputs, and the evaluateAgentTurn mutation inserted an evaluation row that fed the victim’s turn to the default LLM, potentially exposing sensitive content. The flaw is present in the associated grader service as well.

The affected product is Twenty, the open‑source CRM from TwentyHQ. Versions prior to 2.9.0 are impacted. Users running 2.8.x or lower need to upgrade to avoid the IDOR vulnerability.

The CVSS score is 7.6, indicating a moderate‑to‑high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user possessing the AI settings capability; such a user can simply query the agentTurns endpoint or call evaluateAgentTurn with a known UUID to access another workspace’s data or trigger LLM evaluation on that workspace’s content. The vulnerability can be exploited without external network intervention, but requires legitimate application access and the AI flag. Because the flaw can lead to full data disclosure for an attacker, it represents a significant risk to confidentiality for all workspaces on the instance.