---
id: CVE-2026-73069
title: Twenty is an open-source CRM (customer relationship management) platform
summary: >-
  Twenty is an open-source CRM (customer relationship management) platform.
  Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL
  permission to supply settings.asExpression for the system TS_VECTOR field
  searchVecto…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-89
published: '2026-08-11'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:46:02.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73069'
references:
  - url: >-
      https://github.com/twentyhq/twenty/commit/0b8368cd6c1a47711bf52972800f162bde0bbab9
    label: security-advisories@github.com
  - url: 'https://github.com/twentyhq/twenty/pull/21947'
    label: security-advisories@github.com
  - url: 'https://github.com/twentyhq/twenty/security/advisories/GHSA-mm7j-q9q3-qqwj'
    label: security-advisories@github.com
  - url: 'https://github.com/twentyhq/twenty/security/advisories/GHSA-mm7j-q9q3-qqwj'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0045
epssPercentile: 0.38508
ingestedAt: '2026-09-09T21:22:45.527Z'
---

## Overview

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.