Executive brief
Twenty is an open-source customer relationship management platform used to organize company and contact data. Users who are denied access to specific fields can still infer their values by filtering on those restricted fields and observing whether results are returned, allowing them to reconstruct sensitive information from records they can otherwise see.
Technical details
Field-level read permissions in Twenty are enforced on output fields in GraphQL and REST responses, but not on filter predicates in direct filters, relation filters, or persisted view filters. An authenticated user can submit filter conditions on restricted fields and use the resulting totalCount or row presence as a boolean oracle to enumerate denied field values. This affects both direct field filtering and cross-relation filtering through related objects.
Affected products
- Twenty Twenty before 2.22.0
Timeline
- 2026-09-22: disclosed
- 2026-07-16: patched: Fix released in version 2.22.0