CVE-2026-46624: Twenty CRM SQL Injection Enables RCE

Are You Affected?

CVE-2026-46624 is a critical Twenty CRM vulnerability affecting versions 1.7.7 through 1.16.7, inclusive. Twenty is an open-source CRM application. The vulnerable request path involves the REST API’s groupBy functionality and the timeZone field within the group_by query parameter.

Organizations running any listed version should treat the deployment as potentially affected until the vendor advisory confirms a patched release and the upgrade has been completed. Authentication narrows the attacker pool, but it does not make the issue low risk. Compromised credentials, excessive account provisioning, weak tenant controls, or an exposed login surface can make authenticated exploitation practical.

The PostgreSQL configuration is a major risk modifier. The described command-execution chain depends on the application’s PostgreSQL account having superuser privileges. A deployment using a non-superuser, least-privileged database role may block the final operating-system command-execution step, but it can remain vulnerable to SQL injection and data access. Do not use database-role hardening as a replacement for upgrading.

Analyst’s Take: Treat this as an upgrade-first issue, with database privilege reduction as an immediate containment measure rather than a fix. The absence of confirmed exploitation or a public PoC does not offset the 9.9 rating and the possibility of host-level command execution when the application database role is a PostgreSQL superuser.

For broader security context, see our DORA guidance for third-party vendors and cloud providers.

The Fix, If You’re in a Hurry

The supplied NVD information does not state a fixed Twenty version. The authoritative remediation source is Twenty’s security advisory, GHSA-jgx4-6mr9-9573:

https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573

Before changing production systems, confirm the advisory’s patched release and deployment instructions. Do not assume that upgrading to the newest currently available image or package is sufficient unless the release notes or advisory explicitly identify the fix. Record the running version, back up the database, test the upgrade in a staging environment, and verify the deployed image or package digest after rollout.

For a containerized deployment, the exact image tag must come from the vendor advisory or the organization’s approved release process. A generic command illustrates the required workflow without asserting an unverified fixed tag:

# Confirm the currently deployed version first
docker compose exec twenty ./path/to/version-command

# Replace <vendor-confirmed-fixed-tag> with the release named by Twenty
export TWENTY_IMAGE_TAG="<vendor-confirmed-fixed-tag>"
docker compose pull
docker compose up -d
docker compose ps

If a fixed release cannot yet be confirmed, apply compensating controls immediately:

• Restrict access to the Twenty API through a VPN, identity-aware proxy, or allowlist.
• Disable unnecessary public exposure.
• Review user accounts, sessions, and API tokens.
• Ensure the application database role is not a PostgreSQL superuser.
• Monitor database and host activity for signs of exploitation.
• Prepare to rotate credentials accessible to the application or database process.

The role change requires testing because Twenty may depend on permissions beyond ordinary table access.

-- Run as an administrative PostgreSQL role.
-- Review first; do not execute blindly in production.
SELECT rolname, rolsuper
FROM pg_roles
WHERE rolname = '<twenty_application_role>';

ALTER ROLE <twenty_application_role> NOSUPERUSER;

The role change can prevent COPY TO PROGRAM execution by the application account, but it does not remove the underlying injection flaw. Continue to patch and monitor for evidence of prior compromise.

How This Vulnerability Works

The reported root cause is unsafe construction of a SQL expression in Twenty’s group-by query handling. The timeZone value supplied inside the group_by query parameter is reportedly inserted directly into a raw SQL expression using JavaScript template literals. The value is not parameterized, validated, or escaped before reaching the database query.

The affected code path identified by the NVD record is:

engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts

In simplified form, the vulnerable pattern is equivalent to constructing SQL with untrusted input embedded in a string:

// Conceptual pattern only; not an exploit
const expression = `some_sql_expression AT TIME ZONE '${timeZone}'`;

The exact implementation and remediation should be taken from the vendor’s source and advisory. The security issue is the trust boundary: a request-controlled value enters SQL syntax rather than being passed as a safely bound parameter or accepted only from a strict allowlist.

The NVD description states that an attacker can chain this SQL injection with PostgreSQL’s COPY TO PROGRAM capability. PostgreSQL can use that capability to invoke an operating-system command, but it requires sufficient database privileges. Consequently, the complete RCE path depends on the application’s database connection operating as a PostgreSQL superuser or otherwise possessing the required permissions.

This is an application-to-database-to-operating-system escalation chain. The vulnerable endpoint is reachable over the network, but the description requires an authenticated user. The potential impact includes compromise of the database host, access to application secrets, manipulation or theft of CRM data, and lateral movement using credentials or network access available to the database process.

Severity, Explained

The reported CVSS base score is 9.9, Critical. The supplied NVD record does not include the CVSS vector string, so the individual metric values cannot be quoted reliably. Defenders should not infer exact values for attack complexity, privileges required, user interaction, scope, confidentiality, integrity, or availability from the score alone.

The high score is consistent with a network-reachable API vulnerability that can result in arbitrary operating-system command execution. Although authentication is required according to the vulnerability description, many CRM deployments expose login services to the internet and may have a broad population of users, service accounts, integrations, or API tokens. The impact is especially severe when the database server hosts the application, stores cloud credentials, or can reach internal management systems.

Deployment context still matters. A database account with superuser privileges substantially increases the likelihood that SQL injection becomes host-level command execution. A non-superuser account may limit the demonstrated chain, but the application can still be exposed to unauthorized query manipulation, data disclosure, or data modification. Network segmentation, egress controls, credential isolation, and host monitoring therefore remain important even after database privileges are reduced.

Is It Being Exploited?

CVE-2026-46624 is not listed in the CISA Known Exploited Vulnerabilities catalog based on the supplied lookup. No CISA date added, federal remediation deadline, required action, or ransomware-campaign designation applies. The available research also does not identify confirmed exploitation in the wild.

The supplied NVD record references Twenty’s GitHub security advisory but does not identify a separate public proof-of-concept repository. The current evidence therefore supports the following status: no confirmed in-the-wild exploitation identified and no separate public PoC identified in the supplied sources. This status can change after disclosure, and absence from KEV is not evidence that exploitation is impossible.

Treat the vulnerability as high priority despite the current exploitation status. The attack chain is technically straightforward for an attacker who has valid credentials and reaches the affected endpoint, particularly in deployments that use a PostgreSQL superuser. Investigate suspicious activity retrospectively rather than waiting for a KEV listing or public exploit publication.