CVE-2026-92771 — Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attacker…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7