What’s Vulnerable › Vulnerabilities

CVE-2026-92771: Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-23
• Weakness: CWE-863

Description

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.

Affected products

• twentyhq twenty: before 2.35.0 — fixed in 2.35.0

How to fix

Upgrade to a fixed version: twentyhq twenty 2.35.0. Check the vendor advisory for mitigations.

References

• https://github.com/twentyhq/twenty
• https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243
• https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53
• https://github.com/twentyhq/twenty/issues/25911
• https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query
• https://github.com/twentyhq/twenty/issues/25911

Get alerted when CVE-2026-92771 or the next vulnerability affects your stack