CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...