HIGH 7.1 NVD
CVE-2026-92771
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
References
- https://github.com/twentyhq/twenty
- https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/a
- https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/t
- https://github.com/twentyhq/twenty/issues/25911
- https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-wi
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-16 via NVD.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.