CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92771

Twenty (by twentyhq) before 2.35.0 contains a permission bypass in the groupBy-with-records GraphQL resolver within the twenty-server engine. The resolver fails to validate field and row permissions, allowing authenticated users who hold canReadObjectRecords but have canReadFieldValue set to fals...