CVE-2026-73069

This CVE exposes a permission boundary violation disguised as a SQL injection bug. The vulnerability isn't fundamentally about unescaped string concatenation in buildSqlColumnDefinition—it's that a workspace administrator with DATA_MODEL permission can reach system-level schema generation at all. In a multi-tenant CRM, workspace admins should manage tenant-specific data and application-layer configurations, not touch generated SQL that operates at the database infrastructure layer. The critical detail the CVSS misses: the searchVector field is a PostgreSQL TS_VECTOR column governing full-text search across ALL tenant data in the system. When one tenant redefines its GENERATED ALWAYS AS expression, they're not escalating within their own workspace—they're injecting into shared infrastructure that serves the entire deployment. The blast radius is total: one malicious tenant can corrupt or degrade search functionality for every tenant in the system. PostgreSQL doesn't version-control DDL, so auditing what the expression was before tampering becomesforensically difficult. The fix in 2.15.0 sanitizes the input path in buildSqlColumnDefinition, but without seeing the diff, there's no way to confirm whether the permission model itself was corrected or if this is simply an allowlist patch on one vector while other system fields remain reachable through DATA_MODEL. The architectural question is whether workspace admins should be able to invoke the ORM schema manager at all, or whether schema-generation operations require a separate SYSTEM_SCHEMA permission that tenant administrators inherently cannot hold. Check your deployment for other system fields or schema operations reachable through DATA_MODEL permissions. The pattern that created this vulnerability—old infrastructure code written for single-tenant trust assumptions, later exposed through workspace-scoped APIs without re-evaluating the threat model—rarely exists in isolation. Audit the workspace-schema-manager directory for other utilities with similar trust assumptions; if buildSqlColumnDefinition wasn't designed for untrusted callers, its neighbors likely weren't either.

Reviewed through automated stages and approved by a human before publication.