Is CVE-2026-92771 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92771?

CVE-2026-92771 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-92771

Description

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.