CVE-2026-73069

creationtimestamp| type| source ---|---|--- 2026-08-11 16:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mst2jqghoc2v 2026-08-11 17:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mst3phfymk2y...

CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...