{"id":"CVE-2026-85055","title":"Twenty is an open-source CRM (customer relationship management) platform","summary":"Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with…","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-200","CWE-285"],"vendor":"twentyhq","product":"twenty","affected":["twenty < 2.22.0"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T20:17:19.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85055","references":[{"url":"https://github.com/twentyhq/twenty/commit/a5108d512f754a937860bda5e0c2c40c7266e19e","label":"security-advisories@github.com"},{"url":"https://github.com/twentyhq/twenty/pull/22873","label":"security-advisories@github.com"},{"url":"https://github.com/twentyhq/twenty/releases/tag/twenty/v2.22.0","label":"security-advisories@github.com"},{"url":"https://github.com/twentyhq/twenty/security/advisories/GHSA-v93q-4jcx-7p9m","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-23T19:18:15.869181Z"},"cvssSource":"cna","epss":0.00427,"epssPercentile":0.34275,"ingestedAt":"2026-09-22T16:06:00.495Z","slug":"CVE-2026-85055","body":"## Overview\n\nTwenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy. This issue is fixed in version 2.22.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}