CVE-2026-73069 in Twenty
Summary
by MITRE • 08/11/2026
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in Twenty CRM affects versions prior to 2.15.0 and represents a critical SQL injection flaw that allows workspace administrators with DATA_MODEL permissions to execute arbitrary PostgreSQL commands. This security weakness stems from inadequate input sanitization within the system's metadata management functionality, specifically when processing settings.asExpression for the system TS_VECTOR field searchVector. The vulnerability manifests through two primary attack vectors: the PATCH /rest/metadata/fields/:id endpoint and the updateOneField GraphQL mutation, both of which permit unvalidated user input to be directly incorporated into SQL command construction.
The technical exploitation occurs within the buildSqlColumnDefinition utility function located at packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts. This function concatenates user-supplied input without proper escaping or validation, creating a scenario where maliciously crafted expressions can be injected into GENERATED ALWAYS AS (...) SQL clauses. When the application processes these malformed inputs, it executes arbitrary PostgreSQL statements with the privileges of the application database user, effectively allowing attackers to perform unauthorized database operations including data exfiltration, modification, or even complete system compromise.
The operational impact of this vulnerability is severe for organizations relying on Twenty CRM, as it provides a path for privilege escalation from workspace administrator level to full database access. An attacker with DATA_MODEL permissions can leverage this flaw to extract sensitive customer information, modify business data, create backdoor accounts, or establish persistent access to the underlying PostgreSQL database. The vulnerability's exploitation requires minimal privileges but yields maximum impact, making it particularly dangerous in multi-tenant environments where administrators may have elevated access rights. This issue aligns with CWE-89 SQL Injection and follows attack patterns described in the MITRE ATT&CK framework under T1078 Valid Accounts and T1566 Phishing, as it exploits legitimate administrative privileges to achieve unauthorized database access.
Organizations should immediately upgrade to version 2.15.0 or later to remediate this vulnerability. Additionally, administrators should implement proper input validation and sanitization measures at multiple layers of the application stack. Security monitoring should be enhanced to detect unusual patterns in metadata modification requests, particularly those involving field definitions and SQL clause generation. The fix implemented in version 2.15.0 likely includes proper escaping mechanisms for user-supplied expressions and stricter validation of inputs passed to database schema generation functions. System administrators should also consider implementing network-level restrictions on GraphQL endpoints and REST APIs that handle metadata operations, reducing the attack surface available to potential exploiters while maintaining legitimate business functionality.