NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
RSS

2026-09-21 Daily Security Intelligence

2 itemsTop severity 10.0 (Critical)CSSA 1 · CVE 1 · Poisoning 0

CSSA Exclusive Early Warning 1

CSSA Exclusive Early Warning 8.7 High

Twenty identity spoofing through forged SSO callbacks leading to complete administrator account takeover

An attacker can exploit a logic flaw in the SSO login callback mechanism. With SECURITY permission, the attacker configures a malicious OIDC identity provider and crafts a request containing the target administrator's email. The system only verifies email ownership and does not bind an external identity identifier or the original authentication source, so it issues a legitimate token directly. This behavior bypasses the IMPERSONATE permission check, secondary verification, and audit logging, fully taking over the accounts of any workspace member, including administrators, and severely damaging system integrity and confidentiality.

Component
Twenty is a customer relationship management system aimed at enterprise user management. Its architecture supports multi-workspace collaboration and single sign-on integration, and is intended to optimize internal resource scheduling, permission configuration, and business-process automation through a unified authentication flow.
Type
Authentication Bypass by Spoofing (CWE-290)
Repo
github.com/twentyhq/twenty · Stars 56861
Remediation
  • Strictly bind SSO login to a pre-linked external identity identifier, forbid implicit association based only on a matching email, and ensure a complete authorization check and audit trail when switching identities.

CVE Intelligence 1

CVE-2026-88856 CVSS 10.0 Critical 2026-09-21

OrdaSoft Joomla Gallery remote code execution vulnerability leading to full server control

Before version 6.2.7 of the OrdaSoft Joomla Gallery extension, its updateOSGallery() function lacks an allowlist check and an is_callable() check on dynamic function calls, creating a severe code-injection (CWE-94) security defect. An attacker can craft an HTTP request containing a specific JSON body and trigger the function through task=update_osgallery, execute the value of the method field as a PHP function name, and pass the value of the package field as the argument. Because callable functions are not restricted, the attacker can directly call dangerous functions such as system, exec, shell_exec, and passthru, thereby executing arbitrary system commands on the server. The vulnerability affects all Joomla sites running an affected version of the extension. An attacker needs an authenticated privileged account to launch the attack; once exploitation succeeds, it leads to remote code execution and complete takeover of server control.

Source
NVD · CVE-2026-88856
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →