Beveiligingsadvies

CVE-2026-92771

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-16 20:32:32

Laatst bijgewerkt 2026-09-16 20:32:32

Toegewezen door VulnCheck

CVSS-score 7.1

Status PUBLISHED

Beschrijving

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied.

← Alle CVE's bekijken Bekijk op cve.org ↗