CVE-2026-55583: Twenty AI agent monitor cross-workspace IDOR in agentTurns and evaluateAgentTurn

Summary

Twenty, an open-source CRM platform, prior to 2.9.0 contained a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/resolvers/agent-turn.resolver.ts. The agentTurns(agentId) query and evaluateAgentTurn(turnId) mutation looked up rows without checking the workspaceId, and the same flaw appears in agent-turn-grader.service.ts. Any authenticated user with the AI settings flag could read another workspace's full chat history, tool calls and outputs, or push that workspace's turn into the default LLM, given the victim's agentId or turnId, which are exposed in the settings page URL.

Mitigation

Fixed in version 2.9.0.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News