CVE-2026-92771: Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Twentyto a version that resolves this vulnerability.Fixed in 2.35.0Patch Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Event History
Frequently Asked Questions
Which users are exposed to this permission bypass?
Authenticated users who have canReadObjectRecords permission but do not have canReadFieldValue permission for restricted fields are able to exploit the affected resolver.
What access does an attacker need to retrieve restricted data?
The attacker needs an authenticated account with permission to read object records. No user interaction is required, and the issue is reachable over the network through the GraphQL resolver.
What data can be exposed?
Restricted field values that would normally be denied by field-level permission checks can be retrieved through the groupBy-with-records GraphQL resolver.