CVE-2026-73069

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.15.0

Description A workspace administrator with the DATA MODEL permission can execute arbitrary PostgreSQL statements as the application database user. This occurs when the settings.asExpression for the system TS VECTOR field searchVector is supplied via the PATCH /rest/metadata/fields/:id endpoint or the updateOneField GraphQL mutation. The issue stems from the buildSqlColumnDefinition() function in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts, which concatenates unescaped input into a GENERATED ALWAYS AS (...) SQL clause.

Recommendations Update to version 2.15.0.