External risk intelligence

Twenty CRM SQL Injection and OS Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-46624

Twenty is a CRM platform commonly deployed as an internet-facing web application. Since the vulnerability is located in the REST API used for standard operations, it is directly reachable in common deployments where the CRM is accessible to users over the internet.

OS Command Injection

Twenty

1.7.7 to before 1.16.7

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Twenty CRM software allows authenticated users to execute arbitrary operating system commands on the database server. This occurs through a combined SQL injection and PostgreSQL attack vector, potentially impacting systems where the PostgreSQL user has superuser privileges and the CRM is accessible externally. The main concern is confirming relevance and exposure.

Unsanitized input allows command execution.
CRM accessible externally; high impact possible.
Verify if this CRM is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the CRM's REST API. This request targets the `groupBy` endpoint, specifically manipulating the `timeZone` parameter. If the PostgreSQL user has superuser privileges, this manipulation can lead to the execution of arbitrary operating system commands on the database server.

Entry Condition: Authenticated user access to the CRM.
Trigger Point: `timeZone` parameter in `groupBy` endpoint.
Resulting Risk: Arbitrary OS command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user to execute arbitrary operating system commands on the database server when the PostgreSQL user has superuser privileges. This could occur through the REST API's `groupBy` endpoint by injecting SQL via the `timeZone` parameter, which is directly interpolated into a raw SQL expression.

Database server OS commands.
Via unsanitized API parameter.
Potential for widespread system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the critical nature of this vulnerability, application owners are primarily responsible for its remediation, with support from infrastructure and security teams. The immediate first step is to identify all instances of the affected CRM, assess their exposure and business criticality, and then coordinate a response with the vendor and internal teams.

Application owners must lead the remediation effort.
Verify CRM reachability and business impact.
Plan coordinated patching or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Twenty CRM?

Twenty is an open-source Customer Relationship Management (CRM) platform designed to help organizations manage their business contacts, pipelines, and customer interactions. It acts as a central hub for data, often requiring database connectivity to store and process complex information, making it a functional backend tool for managing company sales and operational workflows.

What does CVE-2026-46624 mean for system security?

This vulnerability is classified under CWE-89 (SQL Injection) and CWE-78 (OS Command Injection). It describes a security flaw where the software fails to properly sanitize user input, allowing an attacker to inject malicious database queries. By chaining this with PostgreSQL's command execution features, an attacker can bypass standard application logic to execute unauthorized operating system commands directly on the database server.

How is this vulnerability triggered?

The issue is triggered by sending a malicious request to the CRM's REST API, specifically targeting the 'groupBy' endpoint via the 'timeZone' parameter. The application inadvertently processes this input by directly inserting it into a raw SQL query. It is important to note that this attack path requires an authenticated user; non-authenticated users or requests that do not specifically manipulate this parameter will not trigger this command execution flaw.

Why should I be concerned if my CRM is internet-facing?

Halo Surface Signal indicates that Twenty CRM is frequently deployed as an internet-facing application. Because this vulnerability exists within the standard REST API, any deployment reachable over the internet significantly increases the surface area for potential exploitation. If your instance is exposed, an attacker could leverage legitimate access to perform unauthorized actions on your underlying database infrastructure.

What should I do first to address this vulnerability?

Your first step is to perform an inventory of all Twenty CRM instances currently running in your environment to determine if they fall within the affected versions 1.7.7 through 1.16.7. Once identified, evaluate the privileges assigned to your PostgreSQL database user, as the risk is highest when the database operates with superuser permissions. Coordinate with your application and security teams to prioritize applying the vendor-provided updates.

References

github.com/twentyhq/twenty/security/advisories/GHSA-jgx4-6mr9-9573

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.