CVE-2026-46624: Twenty Twenty CRM RCE Vulnerability

CVE-2026-46624 Overview

CVE-2026-46624 is a remote code execution vulnerability in Twenty, an open source customer relationship management (CRM) platform. The flaw affects versions 1.7.7 through 1.16.7 and combines SQL injection with PostgreSQL's COPY TO PROGRAM functionality. Any authenticated user can inject SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. When the PostgreSQL service account holds superuser privileges, the attacker can execute arbitrary operating system commands on the database server. The vulnerability is tracked under CWE-78 (OS Command Injection).

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the database server when PostgreSQL runs as a superuser, leading to full host compromise.

Affected Products

Twenty CRM versions 1.7.7 through 1.16.7
Deployments where PostgreSQL is configured with a superuser database role
Self-hosted instances exposing the REST API groupBy endpoint

Discovery Timeline

2026-05-26 - CVE-2026-46624 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46624

Vulnerability Analysis

The vulnerability resides in engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals. No parameterization, validation, or escaping occurs before the value reaches the database. An authenticated user supplies attacker-controlled SQL through the REST API, breaking out of the intended expression context.

When PostgreSQL holds superuser privileges, the attacker chains the injection with COPY TO PROGRAM. This PostgreSQL feature executes shell commands on the database host as the PostgreSQL service account. The result is full operating system command execution from a network-reachable application endpoint.

Root Cause

The root cause is unsafe string interpolation of user input into a raw SQL statement. JavaScript template literals concatenate the timeZone value directly into the query string. The code path bypasses the parameter binding mechanisms that the underlying database driver provides for safe value handling.

Attack Vector

Exploitation requires only an authenticated session and network access to the REST API. The attacker sends a crafted request to the groupBy endpoint with a malicious timeZone value. The injected SQL executes within the database session. With superuser context, the payload invokes COPY TO PROGRAM to run arbitrary shell commands. No user interaction is required beyond the initial authenticated request.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-jgx4-6mr9-9573 for vendor-provided technical details.

Detection Methods for CVE-2026-46624

Indicators of Compromise

Unexpected child processes spawned by the PostgreSQL service account such as sh, bash, curl, wget, or nc
PostgreSQL logs containing COPY ... TO PROGRAM statements not originating from administrative tooling
Outbound network connections originating from the database host to unfamiliar destinations

Detection Strategies

Inspect application access logs for requests to the REST groupBy endpoint containing suspicious timeZone values with quotes, semicolons, or SQL keywords
Enable PostgreSQL statement logging (log_statement = 'all') and alert on COPY TO PROGRAM usage
Correlate authenticated API sessions with database query patterns to identify abnormal SQL constructs

Monitoring Recommendations

Monitor process creation events on database hosts and flag processes whose parent is postgres
Track egress traffic from database servers; legitimate database hosts rarely initiate outbound connections to arbitrary endpoints
Audit Twenty CRM user accounts for unusual activity patterns or recently created low-privilege users issuing analytic queries

How to Mitigate CVE-2026-46624

Immediate Actions Required

Upgrade Twenty CRM to a patched release above version 1.16.7 as published in the vendor advisory
Reconfigure PostgreSQL so the Twenty application database role is not a superuser
Restrict network access to the REST API and require strong authentication on all accounts

Patch Information

The vendor has issued fix guidance in the Twenty GitHub Security Advisory GHSA-jgx4-6mr9-9573. Administrators should upgrade to the fixed release and rotate any credentials that may have been exposed on affected hosts.

Workarounds

Revoke superuser privileges from the PostgreSQL role used by Twenty, which neutralizes the COPY TO PROGRAM escalation path
Restrict access to the groupBy REST endpoint at the reverse proxy or web application firewall layer until patching is complete
Audit and disable unused Twenty CRM accounts to reduce the authenticated attack surface

bash

# Remove superuser privilege from the Twenty database role
sudo -u postgres psql -c "ALTER ROLE twenty_app NOSUPERUSER;"

# Verify the role no longer has superuser rights
sudo -u postgres psql -c "\du twenty_app"