Twenty CRM EUVD-2026-56221

Exploitation requires an authenticated Twenty account that is a workspace administrator holding the DATA_MODEL permission (per CVSS PR:H) and network access to the metadata API. The specific trigger is supplying a crafted settings.asExpression value for the system TS_VECTOR searchVector field via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation on a version prior to 2.15.0. Limiting factors: this is not exploitable by unauthenticated or low-privilege users, no default/unprivileged path exists, and the impact is bounded by the privileges of the application's PostgreSQL role - a least-privileged DB role constrains what injected SQL can achieve. No special non-default product configuration is otherwise needed beyond possessing the DATA_MODEL grant.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C, C:H/I:H/A:H = 9.1) is internally consistent with the description: network-reachable REST/GraphQL endpoints, low complexity, no user interaction, but high privileges (workspace admin with DATA_MODEL). The scope change (S:C) is justified because arbitrary SQL as the application DB user reaches beyond the vulnerable metadata component into the entire database, plausibly across tenants. The dominant limiting factor is PR:H - this is not an unauthenticated internet-facing bug; the attacker must already control a privileged workspace-admin account, which sharply narrows the realistic threat to malicious or compromised administrators and insider/privilege-abuse scenarios rather than mass exploitation. No EPSS score was provided and the CVE is not in CISA KEV, so there is no signal of active or automatable widespread exploitation. Net: a genuinely high-impact post-authentication flaw worth prompt patching, but not a drive-by mass-exploitation priority given the high-privilege precondition.

A malicious or compromised workspace administrator with the DATA_MODEL permission sends a PATCH /rest/metadata/fields/:id (or updateOneField GraphQL mutation) targeting the searchVector field with a crafted asExpression that closes the GENERATED ALWAYS AS (...) clause and appends attacker SQL. When Twenty applies the schema migration, the injected statements run as the application database user, allowing data exfiltration, tampering, or destructive DDL. No public exploit code is identified, but the fix's test cases demonstrate concrete breakout payloads (statement terminators, dollar-quoting and quoted-identifier desync tricks).