---
cve: "CVE-2026-92771"
severity: "HIGH"
cvss: 7.1
epss: "0.3%"
vendor: "twentyhq"
kev: false
exploited: false
published: "2026-09-16 21:17:25"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-19T23:35:13+02:00"
---

# CVE-2026-92771

> 7.1 HIGH · 🧪 PoC

## Beschreibung

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- 315697a079506621110a1e9ae65293c80b5df38e (Commit)

## Referenzen

- <https://github.com/twentyhq/twenty/issues/25911>
- <https://github.com/twentyhq/twenty>
- <https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts#L47-L53>
- <https://github.com/twentyhq/twenty/blob/twenty/v2.14.0/packages/twenty-server/src/engine/api/graphql/graphql-query-runner/group-by/services/group-by-with-records.service.ts#L243>
- <https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-92771) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_