Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-46624

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.5%
CVSS Severity
CVSS v3 Score 9.9
Products affected by CVE-2026-46624
  • Twenty » Twenty » Version: 1.10.0
    cpe:2.3:a:twenty:twenty:1.10.0
  • Twenty » Twenty » Version: 1.10.1
    cpe:2.3:a:twenty:twenty:1.10.1
  • Twenty » Twenty » Version: 1.10.2
    cpe:2.3:a:twenty:twenty:1.10.2
  • Twenty » Twenty » Version: 1.10.3
    cpe:2.3:a:twenty:twenty:1.10.3
  • Twenty » Twenty » Version: 1.10.4
    cpe:2.3:a:twenty:twenty:1.10.4
  • Twenty » Twenty » Version: 1.10.5
    cpe:2.3:a:twenty:twenty:1.10.5
  • Twenty » Twenty » Version: 1.10.6
    cpe:2.3:a:twenty:twenty:1.10.6
  • Twenty » Twenty » Version: 1.10.7
    cpe:2.3:a:twenty:twenty:1.10.7
  • Twenty » Twenty » Version: 1.10.8
    cpe:2.3:a:twenty:twenty:1.10.8
  • Twenty » Twenty » Version: 1.11.0
    cpe:2.3:a:twenty:twenty:1.11.0
  • Twenty » Twenty » Version: 1.11.1
    cpe:2.3:a:twenty:twenty:1.11.1
  • Twenty » Twenty » Version: 1.11.10
    cpe:2.3:a:twenty:twenty:1.11.10
  • Twenty » Twenty » Version: 1.11.11
    cpe:2.3:a:twenty:twenty:1.11.11
  • Twenty » Twenty » Version: 1.11.12
    cpe:2.3:a:twenty:twenty:1.11.12
  • Twenty » Twenty » Version: 1.11.13
    cpe:2.3:a:twenty:twenty:1.11.13
  • Twenty » Twenty » Version: 1.11.14
    cpe:2.3:a:twenty:twenty:1.11.14
  • Twenty » Twenty » Version: 1.11.2
    cpe:2.3:a:twenty:twenty:1.11.2
  • Twenty » Twenty » Version: 1.11.3
    cpe:2.3:a:twenty:twenty:1.11.3
  • Twenty » Twenty » Version: 1.11.4
    cpe:2.3:a:twenty:twenty:1.11.4
  • Twenty » Twenty » Version: 1.11.5
    cpe:2.3:a:twenty:twenty:1.11.5
  • Twenty » Twenty » Version: 1.11.6
    cpe:2.3:a:twenty:twenty:1.11.6
  • Twenty » Twenty » Version: 1.11.7
    cpe:2.3:a:twenty:twenty:1.11.7
  • Twenty » Twenty » Version: 1.11.8
    cpe:2.3:a:twenty:twenty:1.11.8
  • Twenty » Twenty » Version: 1.11.9
    cpe:2.3:a:twenty:twenty:1.11.9
  • Twenty » Twenty » Version: 1.12.0
    cpe:2.3:a:twenty:twenty:1.12.0
  • Twenty » Twenty » Version: 1.12.1
    cpe:2.3:a:twenty:twenty:1.12.1
  • Twenty » Twenty » Version: 1.12.10
    cpe:2.3:a:twenty:twenty:1.12.10
  • Twenty » Twenty » Version: 1.12.11
    cpe:2.3:a:twenty:twenty:1.12.11
  • Twenty » Twenty » Version: 1.12.12
    cpe:2.3:a:twenty:twenty:1.12.12
  • Twenty » Twenty » Version: 1.12.13
    cpe:2.3:a:twenty:twenty:1.12.13
  • Twenty » Twenty » Version: 1.12.14
    cpe:2.3:a:twenty:twenty:1.12.14
  • Twenty » Twenty » Version: 1.12.15
    cpe:2.3:a:twenty:twenty:1.12.15
  • Twenty » Twenty » Version: 1.12.16
    cpe:2.3:a:twenty:twenty:1.12.16
  • Twenty » Twenty » Version: 1.12.17
    cpe:2.3:a:twenty:twenty:1.12.17
  • Twenty » Twenty » Version: 1.12.18
    cpe:2.3:a:twenty:twenty:1.12.18
  • Twenty » Twenty » Version: 1.12.2
    cpe:2.3:a:twenty:twenty:1.12.2
  • Twenty » Twenty » Version: 1.12.3
    cpe:2.3:a:twenty:twenty:1.12.3
  • Twenty » Twenty » Version: 1.12.4
    cpe:2.3:a:twenty:twenty:1.12.4
  • Twenty » Twenty » Version: 1.12.5
    cpe:2.3:a:twenty:twenty:1.12.5
  • Twenty » Twenty » Version: 1.12.6
    cpe:2.3:a:twenty:twenty:1.12.6
  • Twenty » Twenty » Version: 1.12.7
    cpe:2.3:a:twenty:twenty:1.12.7
  • Twenty » Twenty » Version: 1.12.8
    cpe:2.3:a:twenty:twenty:1.12.8
  • Twenty » Twenty » Version: 1.12.9
    cpe:2.3:a:twenty:twenty:1.12.9
  • Twenty » Twenty » Version: 1.13.0
    cpe:2.3:a:twenty:twenty:1.13.0
  • Twenty » Twenty » Version: 1.13.1
    cpe:2.3:a:twenty:twenty:1.13.1
  • Twenty » Twenty » Version: 1.13.10
    cpe:2.3:a:twenty:twenty:1.13.10
  • Twenty » Twenty » Version: 1.13.11
    cpe:2.3:a:twenty:twenty:1.13.11
  • Twenty » Twenty » Version: 1.13.2
    cpe:2.3:a:twenty:twenty:1.13.2
  • Twenty » Twenty » Version: 1.13.3
    cpe:2.3:a:twenty:twenty:1.13.3
  • Twenty » Twenty » Version: 1.13.4
    cpe:2.3:a:twenty:twenty:1.13.4
  • Twenty » Twenty » Version: 1.13.5
    cpe:2.3:a:twenty:twenty:1.13.5
  • Twenty » Twenty » Version: 1.13.6
    cpe:2.3:a:twenty:twenty:1.13.6
  • Twenty » Twenty » Version: 1.13.7
    cpe:2.3:a:twenty:twenty:1.13.7
  • Twenty » Twenty » Version: 1.13.8
    cpe:2.3:a:twenty:twenty:1.13.8
  • Twenty » Twenty » Version: 1.13.9
    cpe:2.3:a:twenty:twenty:1.13.9
  • Twenty » Twenty » Version: 1.14.0
    cpe:2.3:a:twenty:twenty:1.14.0
  • Twenty » Twenty » Version: 1.14.1
    cpe:2.3:a:twenty:twenty:1.14.1
  • Twenty » Twenty » Version: 1.14.2
    cpe:2.3:a:twenty:twenty:1.14.2
  • Twenty » Twenty » Version: 1.14.3
    cpe:2.3:a:twenty:twenty:1.14.3
  • Twenty » Twenty » Version: 1.14.4
    cpe:2.3:a:twenty:twenty:1.14.4
  • Twenty » Twenty » Version: 1.15.0
    cpe:2.3:a:twenty:twenty:1.15.0
  • Twenty » Twenty » Version: 1.15.1
    cpe:2.3:a:twenty:twenty:1.15.1
  • Twenty » Twenty » Version: 1.15.10
    cpe:2.3:a:twenty:twenty:1.15.10
  • Twenty » Twenty » Version: 1.15.2
    cpe:2.3:a:twenty:twenty:1.15.2
  • Twenty » Twenty » Version: 1.15.3
    cpe:2.3:a:twenty:twenty:1.15.3
  • Twenty » Twenty » Version: 1.15.4
    cpe:2.3:a:twenty:twenty:1.15.4
  • Twenty » Twenty » Version: 1.15.5
    cpe:2.3:a:twenty:twenty:1.15.5
  • Twenty » Twenty » Version: 1.15.6
    cpe:2.3:a:twenty:twenty:1.15.6
  • Twenty » Twenty » Version: 1.15.7
    cpe:2.3:a:twenty:twenty:1.15.7
  • Twenty » Twenty » Version: 1.15.8
    cpe:2.3:a:twenty:twenty:1.15.8
  • Twenty » Twenty » Version: 1.15.9
    cpe:2.3:a:twenty:twenty:1.15.9
  • Twenty » Twenty » Version: 1.16.0
    cpe:2.3:a:twenty:twenty:1.16.0
  • Twenty » Twenty » Version: 1.16.1
    cpe:2.3:a:twenty:twenty:1.16.1
  • Twenty » Twenty » Version: 1.16.2
    cpe:2.3:a:twenty:twenty:1.16.2
  • Twenty » Twenty » Version: 1.16.3
    cpe:2.3:a:twenty:twenty:1.16.3
  • Twenty » Twenty » Version: 1.16.4
    cpe:2.3:a:twenty:twenty:1.16.4
  • Twenty » Twenty » Version: 1.16.5
    cpe:2.3:a:twenty:twenty:1.16.5
  • Twenty » Twenty » Version: 1.16.6
    cpe:2.3:a:twenty:twenty:1.16.6
  • Twenty » Twenty » Version: 1.7.10
    cpe:2.3:a:twenty:twenty:1.7.10
  • Twenty » Twenty » Version: 1.7.7
    cpe:2.3:a:twenty:twenty:1.7.7
  • Twenty » Twenty » Version: 1.7.8
    cpe:2.3:a:twenty:twenty:1.7.8
  • Twenty » Twenty » Version: 1.7.9
    cpe:2.3:a:twenty:twenty:1.7.9
  • Twenty » Twenty » Version: 1.8.0
    cpe:2.3:a:twenty:twenty:1.8.0
  • Twenty » Twenty » Version: 1.8.1
    cpe:2.3:a:twenty:twenty:1.8.1
  • Twenty » Twenty » Version: 1.8.10
    cpe:2.3:a:twenty:twenty:1.8.10
  • Twenty » Twenty » Version: 1.8.11
    cpe:2.3:a:twenty:twenty:1.8.11
  • Twenty » Twenty » Version: 1.8.12
    cpe:2.3:a:twenty:twenty:1.8.12
  • Twenty » Twenty » Version: 1.8.13
    cpe:2.3:a:twenty:twenty:1.8.13
  • Twenty » Twenty » Version: 1.8.14
    cpe:2.3:a:twenty:twenty:1.8.14
  • Twenty » Twenty » Version: 1.8.15
    cpe:2.3:a:twenty:twenty:1.8.15
  • Twenty » Twenty » Version: 1.8.2
    cpe:2.3:a:twenty:twenty:1.8.2
  • Twenty » Twenty » Version: 1.8.3
    cpe:2.3:a:twenty:twenty:1.8.3
  • Twenty » Twenty » Version: 1.8.4
    cpe:2.3:a:twenty:twenty:1.8.4
  • Twenty » Twenty » Version: 1.8.5
    cpe:2.3:a:twenty:twenty:1.8.5
  • Twenty » Twenty » Version: 1.8.6
    cpe:2.3:a:twenty:twenty:1.8.6
  • Twenty » Twenty » Version: 1.8.7
    cpe:2.3:a:twenty:twenty:1.8.7
  • Twenty » Twenty » Version: 1.8.8
    cpe:2.3:a:twenty:twenty:1.8.8
  • Twenty » Twenty » Version: 1.8.9
    cpe:2.3:a:twenty:twenty:1.8.9


Products
Pricing
Contact Us

Shodan ® - All rights reserved