Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:04:30 +0000 CVE-2026-92771 — Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query https://cve.radiocsirt.org/vuln/cve-2026-92771 <p><strong>Affected:</strong> twentyhq twenty</p> <p>Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.</p> <p><strong>Affected:</strong> twentyhq twenty</p> <p>Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.</p> https://cve.radiocsirt.org/vuln/cve-2026-92771