high · CVSS v3 6.5 · CVSS v4 7.1
CVE-2026-92771
Twenty versions prior to 2.35.0 contain an authorization bypass vulnerability in the groupBy-with-records GraphQL resolver. Authenticated us
Overview
Twenty versions prior to 2.35.0 contain an authorization bypass vulnerability in the groupBy-with-records GraphQL resolver. Authenticated users with general object read access can bypass field-level permission checks to retrieve restricted data values. Upgrading to version 2.35.0 or later resolves this permission validation failure.
Description
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
Impact
Authenticated users can read restricted data fields, impacting confidentiality. Data integrity and system availability are not directly affected.
Remediation
Upgrade Twenty to version 2.35.0 or higher. Until patched, audit GraphQL traffic for queries invoking the groupBy-with-records resolver and enforce strict network access controls for authenticated users.
Risk context
Rated with a High severity (CVSS v4: 7.1, CVSS v3: 6.5). The vulnerability requires valid authentication, focusing the risk primarily on internal authorization boundary failures.
Affected products
- Twenty < 2.35.0
Scores
- Severity
- high
- CVSS v2
- 6.8
- CVSS v3
- 6.5
- CVSS v4
- 7.1
- EPSS
- —