CVE-2026-92771 Details
Description
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
A permission bypass vulnerability has been identified in Twenty versions prior to 2.35.0. The issue arises in the groupBy-with-records GraphQL resolver, where the application fails to properly validate field and row permissions. This flaw allows authenticated users to circumvent permission checks and access restricted field values that should normally be denied. Specifically, attackers with the canReadObjectRecords permission, but canReadFieldValue set to false, can exploit this vulnerability to retrieve sensitive data through the groupBy resolver.
Users are advised to update to Twenty version 2.35.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/twentyhq/twenty/issues/25911 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/twentyhq/twenty | [email protected] | Vendor |
| https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243 | [email protected] | Source CodeVendor |
| https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53 | [email protected] | Source CodeVendor |
| https://github.com/twentyhq/twenty/issues/25911 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Twenty | >= 0, < 2.35.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |