Executive brief
Twenty CRM, an open-source customer relationship management platform, contains a critical security flaw that allows authenticated users to execute arbitrary commands on the underlying database server. By sending a specially crafted request to the system's reporting features, an attacker can bypass security controls and take full control of the server. This could lead to the theft of sensitive customer data, complete service disruption, or the use of the server as a foothold for further attacks on the corporate network.
Technical details
A critical vulnerability exists in Twenty CRM due to improper sanitization of the 'timeZone' parameter within the REST API 'groupBy' endpoint. The application uses JavaScript template literals to directly interpolate user input into raw SQL expressions in 'get-group-by-expression.util.ts', leading to SQL injection. In environments where the PostgreSQL user has superuser privileges (such as the default Docker deployment), an attacker can chain this SQL injection with the 'COPY TO PROGRAM' command to execute arbitrary OS commands. Exploitation requires network access and low-level authentication but no administrative privileges. The issue is patched in version 1.16.7.
Affected products
- Twenty Twenty CRM 1.7.7 - 1.16.7
Timeline
- 2026-05-17: advisory: Original GitHub security advisory published
- 2026-05-26: disclosed: CVE-2026-46624 published to NVD