CVE-2026-63214
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In SuiteCRM before 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. An account with list permission on a module can bypass the user_hash filter, retrieve password hashes and other database data, and use recovered administrative credentials to compromise the application.
Risk Assessment
A low-privileged user can obtain password hashes and administrative data, potentially leading to full application compromise.
Recommendation
Update SuiteCRM to version 7.15.2 or 8.10.2 and enforce strict structural validation and query parameterization in legacy REST methods.
Other vulnerabilities in SuiteCRM
See all- CVE-2015-5948High
A race condition in SuiteCRM before version 7.2.3 allows remote attackers to execute arbitrary code. This vulnerability exists due to an incomplete fix for CVE-2015-5947.
- CVE-2015-5947High
SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
- CVE-2015-5946High
An incomplete blacklist vulnerability in SuiteCRM version 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
- CVE-2026-71550Critical
In SuiteCRM before 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. An authenticated user with the WorkFlow role can include executable PHP and achieve server-side code execution.
- CVE-2026-100358Critical
In SuiteCRM before 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account.
- CVE-2022-50589Critical
A SQL injection vulnerability in SuiteCRM versions prior to 7.12.6 exists in the processing of the 'uid' parameter within the export functionality. Remote unauthenticated attackers can exploit this flaw to execute arbitrary code.
- CVE-2026-97377High
In SuiteCRM before 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection.
- CVE-2026-71548High
In SuiteCRM before 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database.
- CVE-2026-69145Medium
In SuiteCRM prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents.
- CVE-2026-69144Medium
In SuiteCRM prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean and the revision is served without checking its parent document. A low-privileged authenticated user can download administrator-owned or otherwise protected documents.
Original NVD description (English source)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at /service/v4_1/rest.php and uses get_entry_list, get_entries_count, and query to carry attacker-controlled data or authorization state into the security-sensitive operation. An account with list permission on a module can bypass the user_hash filter, retrieve password hashes and other database data, and use recovered administrative credentials to compromise the application. This issue is fixed in versions 7.15.2 and 8.10.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS