CVE-2026-105763

Name of the Vulnerable Software and Affected Versions Twenty versions 1.20.10 through 2.6.9

Description An issue in the GraphQL /metadata endpoint allows the connectedAccounts query to return connectionParameters from ConnectedAccountDTO for all connected accounts within a workspace. This occurs because the field is not hidden and the lookup process fails to enforce the identity of the calling user or account visibility. Consequently, a standard workspace member can obtain plaintext IMAP, SMTP, and CalDAV passwords of other members, potentially allowing unauthorized access to emails, calendars, and the ability to reset third-party accounts. Workspaces using only Google and Microsoft OAuth are not affected.

Recommendations Update to version 2.7.0.