CVE-2026-92771

Twenty, an open-source CRM, prior to version 2.35.0 fails to enforce field- and row-level permissions in the groupBy-with-records GraphQL resolver (CWE-863, incorrect authorization). An authenticated user who holds object-level read permission (canReadObjectRecords) but has field-level read denied (canReadFieldValue false) can call the groupBy resolver and retrieve restricted field values that the permission system would normally hide. Exploitation requires only a valid low-privilege account and no user interaction, resulting in high confidentiality impact (CVSS 4.0: 7.1 High). Any deployment running an affected version is exposed, since the flaw is reachable through the standard GraphQL API. No public proof-of-concept or in-the-wild exploitation is currently known.

What to do: Upgrade Twenty to version 2.35.0 or later, which fixes the groupBy resolver permission enforcement. Until patched, review user roles for accounts holding canReadObjectRecords and restrict GraphQL API access (e.g., via reverse-proxy rules or allowlists) for untrusted users, and inspect access logs for groupBy queries against objects with restricted fields. Note that any authenticated user account, including low-privilege ones, could have been used to read hidden field values, so consider auditing sensitive fields for unauthorized reads.