CVE-2026-92771: high-severity vulnerability in twentyhq twenty
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
twentyhq · twentyRelated CVEs — twentyhq twenty
In the same product, most dangerous first.
CVE-2026-73069CRITICALTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL ExecutionEPSS 0.7%CVE-2026-46624CRITICALTwenty: SQL Injection via the timeZone fieldEPSS 0.5%CVE-2026-85055HIGHTwenty: Field-level read bypassEPSS 0.4%CVE-2026-82274MEDIUMTwenty Open Redirect via OAuth Propagator CallbackEPSS 0.4%CVE-2026-35451MEDIUMTwenty: Stored XSS via BlockNote FileBlockEPSS 0.3%CVE-2026-105763CRITICALTwenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQLEPSS 0.3%
References
https://github.com/twentyhq/twentyhttps://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53https://github.com/twentyhq/twenty/issues/25911https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query