Compliance Impact

The vulnerability allows an attacker to execute arbitrary OS commands on the database server, potentially compromising the confidentiality, integrity, and availability of data stored within Twenty CRM.

Such a compromise could lead to unauthorized access, modification, or destruction of sensitive personal or health information, which would negatively impact compliance with data protection regulations such as GDPR and HIPAA.

Because the vulnerability enables full control over the database server without requiring administrative privileges, it poses a significant risk to maintaining the security controls mandated by these standards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-46624 is a critical Remote Code Execution (RCE) vulnerability in Twenty CRM versions 1.7.7 through 1.16.7. It arises from a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. The vulnerability exists because the timeZone parameter in the REST API groupBy endpoint is directly inserted into raw SQL expressions without any sanitization, validation, or parameterization.

An authenticated user can exploit this flaw by injecting malicious SQL code through the unsanitized timeZone parameter. If the PostgreSQL user runs as a superuser (as in default Docker deployments), the attacker can execute arbitrary operating system commands on the database server by creating and executing shell scripts via stacked SQL queries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user to execute arbitrary OS commands on the database server, potentially leading to full compromise of the server hosting Twenty CRM.

• Complete loss of confidentiality, as attackers can access sensitive data stored in the database.
• Loss of integrity, since attackers can modify or delete data.
• Loss of availability, as attackers can disrupt or disable the database server.
• No administrative privileges are required to exploit this vulnerability, making it easier for attackers to leverage.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying attempts to exploit the unsanitized timeZone parameter in the REST API groupBy endpoint of Twenty CRM versions 1.7.7 through 1.16.7.

You can monitor logs for suspicious SQL injection patterns or unusual commands targeting the groupBy endpoint, especially those including SQL keywords or attempts to use PostgreSQL COPY TO PROGRAM functionality.

Example commands to detect exploitation attempts might include searching web server or application logs for requests containing the groupBy endpoint with suspicious timeZone parameter values.

• Using grep to find suspicious requests in logs: grep -i 'groupBy.*timeZone' /var/log/twentycrm/access.log
• Searching for SQL keywords or COPY TO PROGRAM usage in logs: grep -E '(COPY TO PROGRAM|;|--|\bselect\b|\binsert\b|\bupdate\b)' /var/log/twentycrm/access.log

Additionally, monitoring PostgreSQL logs for unusual COPY TO PROGRAM commands or shell script executions can help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Upgrade Twenty CRM to a version later than 1.16.7 where this vulnerability is fixed.
• If upgrading is not immediately possible, restrict access to the REST API groupBy endpoint to trusted users only.
• Limit PostgreSQL superuser privileges, especially in Docker deployments, to prevent exploitation of COPY TO PROGRAM.
• Implement input validation and sanitization on the timeZone parameter to prevent SQL injection.
• Monitor logs for suspicious activity and respond promptly to any detected exploitation attempts.

Useful 0 Not Useful 0