{"id":"CVE-2026-92771","state":"PUBLISHED","title":"Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query","description":"Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.","publishedAt":"2026-09-16T20:32:32.661Z","updatedAt":"2026-09-18T18:31:26.228Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["twentyhq twenty"],"affected":[{"vendor":"twentyhq","product":"twenty","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.35.0","versionType":"semver"}]}],"references":["https://github.com/twentyhq/twenty/issues/25911","https://github.com/twentyhq/twenty","https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53","https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243","https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/92xxx/CVE-2026-92771.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92771","state":"PUBLISHED","datePublished":"2026-09-16T20:32:32.661Z","dateUpdated":"2026-09-18T18:31:26.228Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-16T19:15:38.662Z"},"containers":{"cna":{"title":"Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query","descriptions":[{"lang":"en","value":"Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied."}],"affected":[{"vendor":"twentyhq","product":"twenty","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.35.0","versionType":"semver"}]}],"references":[{"url":"https://github.com/twentyhq/twenty/issues/25911","tags":["issue-tracking"],"name":"GitHub Issue #25911"},{"url":"https://github.com/twentyhq/twenty","tags":["product"]},{"url":"https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53","tags":["technical-description"],"name":"getTargetEntityAndOperationType returns early on the subQuery flag, bypassing validation"},{"url":"https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243","tags":["technical-description"],"name":"addPartitionByToQueryBuilder strips aliases to subquery-flagged ones"},{"url":"https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query","name":"VulnCheck Advisory: Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","lang":"en","description":"Incorrect Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-16T20:32:32.661Z"},"datePublic":"2026-09-14T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:twenty:twenty:*:*:*:*:*:*:*:*","versionEndExcluding":"2.35.0"}]}]}],"credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/twentyhq/twenty/issues/25911","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-18T18:30:53.793418Z","id":"CVE-2026-92771","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-18T18:31:26.228Z"}}]}}}