# CVE-2026-46624: Twenty CRM remote code execution via SQL injection in groupBy endpoint

Source: https://junglewise.ai/threats/cve-2026-46624-twenty-crm-remote-code-execution-via-sql-injection-in-groupby  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-46624 · Severity: critical · CVSS 9.9 · Published 2026-05-26

Twenty CRM, an open-source customer relationship management platform, contains a critical security flaw that allows authenticated users to execute arbitrary commands on the underlying database server. By sending a specially crafted request to the system's reporting features, an attacker can bypass security controls and take full control of the server. This could lead to the theft of sensitive customer data, complete service disruption, or the use of the server as a foothold for further attacks on the corporate network.

Vendors: [Twenty](https://junglewise.ai/threats/vendors/twenty).

## Quick answers

**Is CVE-2026-46624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46624 being exploited in the wild.

**How severe is CVE-2026-46624?** Critical severity, with a CVSS score of 9.9, published 26 May 2026.

**Which products and versions are affected?** Twenty CRM 1.7.7 - 1.16.7.

**Is there a fix for CVE-2026-46624?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46624 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46624?** Check whether you run Twenty CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical vulnerability exists in Twenty CRM due to improper sanitization of the 'timeZone' parameter within the REST API 'groupBy' endpoint. The application uses JavaScript template literals to directly interpolate user input into raw SQL expressions in 'get-group-by-expression.util.ts', leading to SQL injection. In environments where the PostgreSQL user has superuser privileges (such as the default Docker deployment), an attacker can chain this SQL injection with the 'COPY TO PROGRAM' command to execute arbitrary OS commands. Exploitation requires network access and low-level authentication but no administrative privileges. The issue is patched in version 1.16.7.

## Affected products

- Twenty Twenty CRM 1.7.7 - 1.16.7

## Timeline

- 2026-05-17: advisory: Original GitHub security advisory published
- 2026-05-26: disclosed: CVE-2026-46624 published to NVD

## References

- [https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573](https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573)