CVE-2026-92771— Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Quick assessment
Affected
twentyhq twenty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2.35.0 之前的 Twenty 版本中， 与 组合的 GraphQL 解析器未正确验证字段和行的权限，使得经过身份验证的用户能够绕过权限检查。拥有 权限但 为 的攻击者，可以通过 解析器获取原本应被拒绝的受限字段值。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92771
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query
Source: CVE Program / CVE List V5
Vulnerability Description
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92771
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92771
请登录查看更多情报信息。
Other References for CVE-2026-92771 (3)
IV. Related Vulnerabilities
Same product: twenty
-
CVE-2026-85055
Twenty: Field-level read bypass -
CVE-2026-82274
Twenty Open Redirect via OAuth Propagator Callback -
CVE-2026-73069
Twenty: SQL Injection in the `searchVector` Field Settings A -
CVE-2026-55583
Twenty: Cross-workspace IDOR in AgentTurnResolver -
CVE-2026-46624
Twenty: SQL Injection via the timeZone field
Same vendor: twentyhq
-
CVE-2026-85055
Twenty: Field-level read bypass -
CVE-2026-82274
Twenty Open Redirect via OAuth Propagator Callback -
CVE-2026-73069
Twenty: SQL Injection in the `searchVector` Field Settings A -
CVE-2026-55583
Twenty: Cross-workspace IDOR in AgentTurnResolver -
CVE-2026-46624
Twenty: SQL Injection via the timeZone field
Same weakness: CWE-863
-
CVE-2026-75745
Adobe Experience Manager Forms JEE | Incorrect Authorization -
CVE-2026-75723
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- -
CVE-2026-75728
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- -
CVE-2026-75608
Frigate: Viewer-Role User Can Access go2rtc Internal API to -
CVE-2026-95654
Databasement before 1.7.14 Authorization Bypass via Stale In
V. Comments for CVE-2026-92771
No comments yet