CVE-2026-85055

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.22.0

Description Field-level read permissions are enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a specific field can reference that denied field in direct filters, relation filters, or persisted view filters. This creates a boolean/count oracle—a mechanism that reveals information through true/false responses or count changes—where the resulting totalCount and row presence reveal if guesses match the actual column data. This allows an attacker to reconstruct denied field values for records exposed by the principal's row-level policy.

Recommendations Update to version 2.22.0.