Vulnerability in Twenty CRM File Serving Endpoints Exploitable by Authenticated Attackers

CVE-2026-44729

What is CVE-2026-44729?

An identified vulnerability allows an authenticated attacker to upload an HTML file that includes JavaScript to Twenty CRM. This is due to improper handling of file serving endpoints, which do not set critical HTTP response headers like Content-Type, Content-Disposition, or X-Content-Type-Options. Consequently, when a victim accesses the uploaded file, the JavaScript is executed within the context of the Twenty CRM domain. This exploit can lead to session hijacking, unauthorized access, and potential data theft, emphasizing the need for mitigative measures to secure file handling processes.

References