CVE-2026-92771
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 16, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 16, 2026
Description
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
twentytwentyhq |
|
References
- GitHub Issue #25911issue-tracking
- https://github.com/twentyhq/twentyproduct
- getTargetEntityAndOperationType returns early on the subQuery flag, bypassing validationtechnical-description
- addPartitionByToQueryBuilder strips aliases to subquery-flagged onestechnical-description
- VulnCheck Advisory: Twenty before 2.35.0 Permission Bypass via groupBy-with-records Querythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.