SQL injection in Twenty CRM searchVector field settings (CVE-2026-73069)

Twenty's metadata field update endpoints (REST and GraphQL) accepted an unvalidated `settings.asExpression` value for the system `searchVector` (TS_VECTOR) field, which was concatenated unescaped into a `GENERATED ALWAYS AS (...)` clause and executed directly against the PostgreSQL database. A workspace administrator holding the `DATA_MODEL` permission could exploit this to execute arbitrary PostgreSQL statements as the application database user, potentially enabling cross-workspace data access or remote code execution on default self-hosted deployments. Affected versions: - < 2.15.0 We recommend updating to: 2.15.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/twentyhq/twenty/security/advisories/GHSA-mm7j-q9q3-qqwj Details: https://vuln.today/cve/CVE-2026-73069