CVE-2026-73069

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.

• CWE-89

• https://github.com/twentyhq/twenty/commit/0b8368cd6c1a47711bf52972800f162bde0bbab9
• https://github.com/twentyhq/twenty/pull/21947
• https://github.com/twentyhq/twenty/security/advisories/GHSA-mm7j-q9q3-qqwj
• https://github.com/twentyhq/twenty/security/advisories/GHSA-mm7j-q9q3-qqwj

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7304SGLangs multimodal generation runtime is vulnerable to unaut…9.8
• CVE-2026-7305A weakness has been identified in Xuxueli xxl-job up to 3.3.…6.3
• CVE-2026-7306A security vulnerability has been detected in Xuxueli xxl-jo…5.6
• CVE-2026-73066Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.8
• CVE-2026-73067Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.7
• CVE-2026-73068ToolJet is the open-source foundation am AI-native platform …5.9
• CVE-2026-7307A flaw was found in Keycloak. A remote, unauthenticated atta…7.5
• CVE-2026-73070Vim is an open source, command line text editor. Prior to 9.…6.8
• CVE-2026-73071Vim is an open source, command line text editor. From 9.2.05…3.3
• CVE-2026-73072Vim is an open source, command line text editor. Prior to 9.…8.5
• CVE-2026-73074Vim is an open source, command line text editor. Prior to 9.…7.1
• CVE-2026-73075Vim is an open source, command line text editor. From 9.2.04…4.6