CVE-2026-92771

Executive Summary

CVE-2026-92771 is an authorization bypass in Twenty (open-source CRM) before version 2.35.0. The groupBy-with-records GraphQL resolver fails to enforce field-level and row-level permission checks, allowing an authenticated user who holds canReadObjectRecords but not canReadFieldValue to read restricted field values they should be denied. The flaw is network-exploitable with low privileges and no user interaction, yielding high confidentiality impact (CVSS 6.5). No public PoC, Nuclei template, or exploit code exists, and patch confidence is 0/4.

Technical Analysis

Twenty exposes CRM data through a GraphQL API. Authorization in Twenty is composed of layered checks: object-record read permission (canReadObjectRecords), field-value read permission (canReadFieldValue), and row-level scoping. The NVD description states that the groupBy resolver that returns records does not validate field and row permissions. This is a classic CWE-863 (Incorrect Authorization) defect: a code path is added or modified without replicating the authorization middleware/logic used by the standard list resolver.

The resolver is resolvable by a normal authenticated session. Because field-level and row-level checks are omitted, the resolver will aggregate and return underlying field values that the caller's role explicitly forbids. The attack surface is the GraphQL endpoint of an affected Twenty deployment (pre-2.35.0). No specific resolver arguments, object/field names, or code paths beyond "groupBy-with-records GraphQL resolver" are provided by the source data; no further implementation detail should be assumed.

Note on metadata quality: the NVD description names the product ("Twenty") and version boundary (before 2.35.0) but does not identify a class name, file path, or query argument. Per accuracy rules, only the terms present in the description (groupBy, canReadObjectRecords, canReadFieldValue, GraphQL resolver) are used below. There is no CNA title, no affected-version list, and no OSV package data. EPSS is unavailable and must not be inferred.

Exploitation Scenarios

All steps are inferred at the vulnerability-class level; no public PoC exists.

1. Reconnaissance / target identification. Identify an internet-exposed or internally reachable Twenty instance running before 2.35.0. Fingerprint via the GraphQL endpoint and version/asset metadata.

2. Prerequisite access. Obtain any authenticated account (low privilege, PR:L) whose role grants canReadObjectRecords but explicitly withholds canReadFieldValue for one or more fields. This is a realistic baseline for a CRM: roles are commonly scoped so users can see rows but not sensitive columns.

3. Triggering the flaw class. Issue a groupBy-with-records query against the GraphQL API. Where the standard record-list resolver would strip or deny forbidden field values, the groupBy resolver dereferences and returns records without re-applying field-level and row-level authorization. The attacker therefore receives field values and rows outside their intended scope.

4. Post-exploitation impact. Bulk extraction of restricted CRM field values (e.g., sensitive attributes) and of rows the user should not see, enabling data exfiltration, competitive intelligence, or pre-attack targeting. No integrity or availability impact per CVSS (I:N/A:N); this is a pure confidentiality breach (C:H).

No payload specifics, argument names, or code snippets are provided by the source data and none are fabricated here.

Impact Assessment

CVSS 3.1 base 6.5 = AV:N / AC:L / PR:L / UI:N / S:U / C:H / I:N / A:N. Network-reachable, low complexity, requires only a low-privileged authenticated account, no user interaction. Impact is contained to the vulnerable Twenty component (S:U) but confidentiality is High: an attacker reads data explicitly denied by policy. Because CRM stores customer PII, deal/contract data, and notes, exposure can trigger privacy/regulatory obligations (GDPR, CCPA), contractual breach, and downstream social-engineering or account-takeover risk. Blast radius = any Twenty deployment < 2.35.0 with roles that differentiate record-read from field-read permissions. No KEV listing and no EPSS score currently published; no evidence of in-the-wild exploitation in the provided data.

Detection Guidance

Detection below targets the behavioral signature (authenticated groupBy-with-records GraphQL requests and anomalous field-access volume) rather than a known payload, since none exists.

Sigma Rule

title: Twenty CRM GroupBy GraphQL Permission Bypass Attempt
id: 8f2c1a44-9277-4c1e-9b3a-20twenty92771
status: experimental
description: Detects GraphQL requests invoking the groupBy-with-records resolver on Twenty instances, potential CVE-2026-92771 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92771
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-path|contains: '/graphql'
  selection_method:
    cs-method: 'POST'
  selection_body:
    cs-uri-query|contains:
      - 'groupBy'
      - 'canReadFieldValue'
  condition: selection_endpoint and selection_method and selection_body
falsepositives:
  - Legitimate dashboard/aggregation queries by privileged users
level: medium
tags:
  - attack.t1213
  - cve.2026.92771

YARA Rule

rule CVE_2026_92771_Twenty_GroupBy_Permission_Bypass
{
    meta:
        description = "Detects GraphQL groupBy-with-records payloads targeting Twenty CVE-2026-92771"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92771"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $gql1 = "groupBy" ascii nocase wide
        $gql2 = "/graphql" ascii nocase wide
        $perm1 = "canReadFieldValue" ascii nocase wide
        $perm2 = "canReadObjectRecords" ascii nocase wide

    condition:
        filesize < 512KB and
        (any of ($gql*) and 1 of ($perm*) or ($gql1 and $gql2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92771 Twenty GraphQL groupBy Permission Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/graphql"; http.request_body; content:"groupBy"; nocase; content:"canReadFieldValue"; nocase; reference:cve,2026-92771; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92771; classtype:attempted-recon; sid:9277101; rev:1;)

Elastic Detection

sequence by user.id, source.ip with maxspan=5m
  [http where http.request.method == "POST" and
      http.request.body.text contains "groupBy" and
      url.path contains "/graphql"]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=suricata
| search uri_path="/graphql" method=POST
| eval body=coalesce(request_body, cs_uri_query, "")
| where like(body, "%groupBy%")
| stats count values(src_ip) as src_ips values(user) as users by uri_path
| where count > 5

Wazuh OSSEC Rule

<group name="twenty,web,cve-2026-92771,">
  <rule id="927710" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/graphql</field>
    <field name="method">POST</field>
    <regex type="pcre2">groupBy</regex>
    <description>CVE-2026-92771: Twenty GraphQL groupBy resolver invoked - possible permission bypass</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>attack,pci_dss_10.2.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No vendor fix reference, affected-version list, or workaround is present in the provided data.

1. Immediate mitigations

   • Restrict network access to the GraphQL API to trusted networks/VPN; do not expose Twenty management interfaces directly to the internet.
   • Audit roles: identify and constrain accounts holding canReadObjectRecords without canReadFieldValue; reduce privileges where possible.
   • Monitor GraphQL logs for groupBy-with-records requests and anomalous field-access volume (see Detection Guidance).
   • If feasible, disable or block the groupBy resolver at a reverse-proxy/WAF layer for untrusted clients.

2. Patch / upgrade steps

   • The NVD description references version 2.35.0 as the first fixed release; treat "upgrade to 2.35.0 or later" as the vendor-stated remediation, but verify against the official Twenty release/advisory before relying on it, since no patch source is tracked here (patch confidence 0/4).
   • Stage upgrades and re-test role-scoped field access post-upgrade.

3. Long-term hardening

   • Enforce authorization at a single centralized layer so all resolvers (including groupBy) share identical field- and row-level checks.
   • Add automated regression tests asserting canReadFieldValue denial across every resolver.
   • Adopt least-privilege role design and continuous permission review.

References

1. NVD — CVE-2026-92771: https://nvd.nist.gov/vuln/detail/CVE-2026-92771
2. Twenty project repository / release notes (verify 2.35.0 fix): https://github.com/twentyhq/twenty
3. Twenty official documentation: https://twenty.com
4. CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. CISA KEV Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor: No public PoC, exploit code, Nuclei template, or KEV entry exists in the provided data. No named threat actor campaign is associated. EPSS not yet scored by FIRST.org.