CVE-2026-92771
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92771
PublishedTwenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92771 · CVE overview and exploitation status
cve-program · CVE-2026-92771
- https://github.com/twentyhq/twenty/issues/25911
- https://github.com/twentyhq/twenty
- https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53
- https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243
- https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query
Related changes
Linked by CVE identifierNo related changes are available here.