Twenty, an open‑source CRM platform, does not enforce field‑level read permissions on GraphQL or REST filter predicates in versions prior to 2.22.0. As a result, a user who can read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The API then returns counts or row presence that reveal whether the guessed values match the real column, effectively creating a boolean/count oracle. An attacker can use this oracle to reconstruct denied field values for records covered by the requester's row‑level policy. This flaw leads to unauthorized disclosure of sensitive data and is classified under CWE‑200 and CWE‑285.

The vulnerability affects all installations of the Twenty CRM product manufactured by twentyhq that run any release before v2.22.0. Any user or API key that has permission to read an object but not a specific field is potentially able to exploit the flaw if they can craft the prohibited filter queries.

The CVSS score of 7.1 indicates moderate‑to‑high severity. The EPSS score is not available, suggesting limited data on exploit probability, but the vulnerability is not listed in CISA's KEV catalog, implying no known widespread exploitation. The attack vector is likely via GraphQL or REST APIs where an attacker with legitimate read access sends crafted filter queries. Because the flaw relies on logical inference rather than a direct code execution path, successful exploitation requires iterative querying and analysis of query responses, which is achievable remotely but may require some effort to reconstruct full field values.