EUVD-2026-84513

Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...

CVE-2026-85055 Twenty: Field-level read bypass

Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...

CVE-2026-85055 Twenty: Field-level read bypass

Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...

CVE-2026-85055: Exposure of Sensitive Information to an Unauthorized Actor

Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...

PT-2026-96812

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.22.0 Description Field-level read permissions are enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a specific...

CVE-2026-63460

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

EUVD-2026-81667

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

Exploit for CVE-2026-44840

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassw...

EUVD-2026-81294

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

PT-2026-95046

Summary !IMPORTANT Only instances running on the SQLite driver better-sqlite3 are affected; SQLite is usually used in development/testing backend, so production deployments on PostgreSQL or MySQL/MariaDB are unaffected. The StringOperators.regex filter exposed on the public Shop GraphQL API is...

CVE-2026-63460: Inefficient Regular Expression Complexity

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

PT-2026-94344

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description An unauthenticated Regular Expression Denial of Service ReDoS exists in the public Shop GraphQL API. The issue occurs when the StringOperators.regex filter is used, as the raw pattern is passed to a...

CVE-2026-92594

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594

Craft CMS versions 5.0.0-RC1 through before 5.11.0 contain an authorization flaw in the GraphQL API's draftCreator and revisionCreator fields. Instead of requiring the usergroups.*:read scope enforced by Gql::canQueryUsers(), these fields are gated only on elements.drafts:read or elements.revisio...

CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92774

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92771

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92774

Wiki.js through version 2.5.314 is affected by an authorization bypass in its GraphQL API. The root cause is the omission of page tags from authorization checks in multiple resolvers (list , tree , tags , searchTags , and links ), allowing attackers with low privileges to bypass tag-based access ...