EUVD-2026-81035
GHSA-7q37-3m9h-f5mp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network GraphQL endpoint (AV:N/AC:L), requires a low-privileged authenticated account (PR:L), no user interaction; read-only bypass yields confidentiality loss (C:H) with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.
AnalysisAI
Twenty CRM before 2.35.0 fails to enforce field- and row-level permission checks inside the groupBy-with-records GraphQL resolver, letting an authenticated user who holds canReadObjectRecords permission read field values they are explicitly denied by canReadFieldValue. The result is read-only disclosure of restricted record data to a partially privileged account - no modification or denial of service - and no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Twenty account (PR:L) that has been granted canReadObjectRecords permission on the target object but has canReadFieldValue set to false for the specific field(s) sought - i.e., a partial-access role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity authorization flaw, not a high-CVSS-but-low-real-risk inflation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Twenty to version 2.35.0 or later, which is the vendor-released patch per the VulnCheck advisory (https://www.vulncheck.com/advisories/twenty-before-2.35.0-permission-bypass-via-groupby-with-records-query) and the upstream issue at https://github.com/twentyhq/twenty/issues/25911. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Twenty CRM deployments and confirm which are running versions below 2.35.0, prioritizing any instance reachable from the internet or shared with external or broad internal user populations; temporarily reduce the set of accounts holding canReadObjectRecords where business operations permit, and enable audit logging or monitoring focused on groupBy-with-records GraphQL queries for unusual or bulk field access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Twenty CRM v1.15.0 has a code injection vulnerability enabling remote attackers to execute arbitrary code through the CR
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. Rated high severi
Remote code execution in Twenty CRM versions 1.7.7 through 1.16.7 allows authenticated users to execute arbitrary OS com
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload. Rated medium severity (CVSS 5.4), this vuln
SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission i
Stored cross-site scripting in Twenty CRM versions 1.18.0 and earlier allows authenticated users to upload HTML/JavaScri
Server-side request forgery (SSRF) in Twenty CRM allows authenticated users to bypass IP filtering protections and acces
Cross-workspace data disclosure in Twenty CRM before 2.9.0 lets any authenticated user holding the AI settings flag (a w
Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious Ja
OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM throu
Twenty CRM versions prior to 1.18 allow authenticated users to bypass SSRF protections by exploiting unvalidated HTTP re
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today