CVE-2026-73069: falha crítica em twentyhq twenty
Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.7%
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
twentyhq · twentyCVEs relacionadas — twentyhq twenty
No mesmo produto, das mais perigosas para as menos.
CVE-2026-46624CRITICALTwenty: SQL Injection via the timeZone fieldEPSS 0.5%CVE-2026-92771HIGHTwenty before 2.35.0 Permission Bypass via groupBy-with-records QueryEPSS 0.4%CVE-2026-85055HIGHTwenty: Field-level read bypassEPSS 0.4%CVE-2026-82274MEDIUMTwenty Open Redirect via OAuth Propagator CallbackEPSS 0.4%CVE-2026-35451MEDIUMTwenty: Stored XSS via BlockNote FileBlockEPSS 0.3%CVE-2026-105763CRITICALTwenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQLEPSS 0.3%