---
id: CVE-2026-92771
title: >-
  Twenty before 2.35.0 fails to validate field and row permissions in the
  groupBy-with-records GraphQL resolver, allowing authenticated users to bypass
  permission checks
summary: >-
  Twenty before 2.35.0 fails to validate field and row permissions in the
  groupBy-with-records GraphQL resolver, allowing authenticated users to bypass
  permission checks. Attackers with canReadObjectRecords permission but
  canReadFieldValue…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
vendor: twentyhq
product: twenty
affected:
  - twenty < 2.35.0
published: '2026-09-16'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:48.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92771'
references:
  - url: 'https://github.com/twentyhq/twenty'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53
    label: disclosure@vulncheck.com
  - url: 'https://github.com/twentyhq/twenty/issues/25911'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query
    label: disclosure@vulncheck.com
  - url: 'https://github.com/twentyhq/twenty/issues/25911'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00319
epssPercentile: 0.25127
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T18:30:53.793418Z'
ingestedAt: '2026-09-16T21:05:36.894Z'
---

## Overview

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.