CVE-2026-46624

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.

• CWE-78
• CWE-89

• https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573Exploit, Vendor Advisory
• https://github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573Exploit, Vendor Advisory

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46617Fission is an open-source, Kubernetes-native serverless fram…8.7
• CVE-2026-46618Fission is an open-source, Kubernetes-native serverless fram…6.9
• CVE-2026-4662The JetEngine plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-46620e107 is a content management system (CMS). Prior to 2.3.5, e…6.5
• CVE-2026-46621Yamcs is a mission control framework. Prior to 5.12.7, the Y…9.1
• CVE-2026-46622SolidInvoice is an open-source invoicing platform. Prior to …8.1
• CVE-2026-46625JavaScript Cookie is a JavaScript API for handling cookies, …7.5
• CVE-2026-46627Twig is a template language for PHP. Prior to 3.26.0, the Tw…6.5
• CVE-2026-46628Twig is a template language for PHP. Prior to 3.26.0, the de…5.4
• CVE-2026-46629Twig is a template language for PHP. Prior to 3.26.0, twig/i…6.5
• CVE-2026-4663Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-46633Twig is a template language for PHP. Prior to 3.26.0, Compil…9.8