The vulnerability CVE-2026-92771 affects twentyhq's twenty product versions prior to 2.35.0. The issue lies in the groupBy-with-records GraphQL resolver, which fails to correctly enforce field and row permission checks. This allows authenticated users who have permission to read object records but lack permission to read specific field values to retrieve those restricted field values through the groupBy resolver, effectively bypassing intended access controls. The CVSS 4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required beyond the stated permissions, and no user interaction needed.

Authenticated users with partial read permissions can access restricted field values that should be denied, potentially exposing sensitive data. The vulnerability does not require elevated privileges beyond canReadObjectRecords and does not require user interaction, making exploitation feasible in environments where such permissions are granted.

Patch to version 2.35.0 or later where this authorization issue is fixed. Since the affected versions are explicitly prior to 2.35.0, upgrading to 2.35.0 or newer will remediate this vulnerability. No vendor advisory or patch link was provided, so confirm patch availability from the vendor's official sources before applying.