CVE-2026-92771

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.35.0

Description Authenticated users can bypass permission checks due to a failure to validate field and row permissions in the groupBy-with-records GraphQL resolver. An attacker possessing the canReadObjectRecords permission, but lacking the canReadFieldValue permission, can retrieve restricted field values through the groupBy resolver that would otherwise be denied.

Recommendations Update to version 2.35.0 or later.