Twenty, an open-source CRM, contains a critical SQL injection flaw in the searchVector field settings. By supplying unescaped input through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, a workspace administrator with DATA_MODEL permission can inject arbitrary PostgreSQL statements. The injection occurs in buildSqlColumnDefinition, where unvalidated input is concatenated into a GENERATED ALWAYS AS expression. Successful exploitation allows the attacker to execute any SQL as the application database user, compromising database confidentiality, integrity, and potentially availability.

The affected product is Twenty CRM. All releases prior to version 2.15.0 are vulnerable. Customers using any older version of the open-source platform are at risk until an upgrade to 2.15.0 or later is performed.

The CVSS score of 9.1 indicates high severity. Because the flaw requires the DATA_MODEL permission, the attack vector is likely a privileged administrator account, which can be accessed remotely if login credentials are compromised or social engineering is employed. No exploit probability data is available via EPSS, and the vulnerability is not listed in CISA KEV. Nonetheless, the combination of a high CVSS score and the ability to run arbitrary SQL makes exploitation highly attractive to attackers with the appropriate privileges.