Remote Code Execution Vulnerability in Twenty CRM by Twenty

CVE-2026-46624

What is CVE-2026-46624?

Twenty CRM, an open-source customer relationship management tool, has a significant vulnerability that allows for remote code execution through a chained SQL injection exploit. This issue, present in versions 1.7.7 through 1.16.7, allows any authenticated user to execute arbitrary operating system commands on the database server. The vulnerability arises from the misuse of the unsanitized timeZone parameter within the REST API's groupBy endpoint, where the parameter is directly interpolated into a raw SQL expression, facilitating the execution of potentially harmful SQL commands without proper validation or escaping. This raises serious security concerns for users with a PostgreSQL superuser configuration.

References