CVE-2026-46624 Details
Description
Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.
A critical remote code execution vulnerability has been identified in Twenty CRM versions 1.7.7 prior to 1.16.7. This vulnerability arises from a combination of SQL injection and a PostgreSQL 'COPY TO PROGRAM' attack. In installations where the PostgreSQL user has superuser privileges, any authenticated user can execute arbitrary operating system commands on the database server. This is achieved by injecting SQL through the unsanitized 'timeZone' parameter in the REST API 'groupBy' endpoint. The vulnerability is present in the file 'engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts', where the 'timeZone' parameter is directly interpolated into a raw SQL expression without proper validation or escaping.
Users can upgrade to Twenty CRM version 1.16.7 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| twenty twenty | >= 1.7.7, < 1.16.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |