# CVE-2026-92771: Twenty GraphQL permission bypass in groupBy-with-records resolver

Source: https://junglewise.ai/threats/cve-2026-92771-twenty-graphql-permission-bypass-in-groupby-with-records-resolver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92771 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Twenty is an open-source alternative to Salesforce used for customer relationship management and data management. The vulnerability allows authenticated users with read access to records but not to sensitive fields to bypass field-level permission checks through a GraphQL resolver, potentially exposing restricted data like confidential customer information or internal notes that should have been hidden.

Technologies: [Twenty](https://junglewise.ai/threats/technologies/twenty). Vendors: [Twenty](https://junglewise.ai/threats/vendors/twenty).

## Quick answers

**Is CVE-2026-92771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92771 being exploited in the wild.

**How severe is CVE-2026-92771?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** Twenty before 2.35.0.

**Is there a fix for CVE-2026-92771?** A patch was published on 2026-09-16: Fixed in version 2.35.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92771 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92771?** Check whether you run Twenty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The groupBy-with-records GraphQL resolver in Twenty before version 2.35.0 fails to properly validate field-level and row-level permissions before returning data. An authenticated attacker with canReadObjectRecords permission but canReadFieldValue set to false can exploit this to retrieve restricted field values that would normally be denied. The vulnerability exists in the resolver logic itself, which processes groupBy queries without enforcing per-field permission checks. This is a permission-bypass issue affecting GraphQL API access and requires valid authentication to exploit, making it actionable only by authenticated users with some baseline permissions.

## Affected products

- Twenty Twenty before 2.35.0

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 2.35.0

## References

- [https://github.com/twentyhq/twenty](https://github.com/twentyhq/twenty)
- [https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts](https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts)

## Related threats

- [Twenty CRM credential disclosure in GraphQL metadata query](https://junglewise.ai/threats/cve-2026-105763-twenty-is-an-open-source-crm-customer-relationship-management)
- [Twenty CRM field-level permission bypass in filters](https://junglewise.ai/threats/cve-2026-85055-twenty-is-an-open-source-crm-customer-relationship-management)
- [Twenty open redirect in OAuth callback handler](https://junglewise.ai/threats/cve-2026-82274-twenty-open-redirect-in-oauth-callback-handler)
- [Twenty CRM SQL injection in search vector field configuration](https://junglewise.ai/threats/cve-2026-73069-twenty-crm-sql-injection-in-search-vector-field-configuration)
- [Twenty CRM IDOR in AI Agent Monitor](https://junglewise.ai/threats/cve-2026-55583-twenty-crm-idor-in-ai-agent-monitor)