CVE-2026-61648 is a high-severity SQL injection vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It arises from improper handling of user-controllable Multi report condition parameters that are concatenated into SQL queries without proper encoding. This flaw allows a low-privileged user with AOR Reports access to read arbitrary database tables and potentially exhaust database connections. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-61650 is a missing authorization vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. The flaw exists in the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint, which improperly checks only view and list permissions instead of requiring edit permissions when modifying one-to-many relationship foreign keys. This allows low-privileged users to reassign records, change ownership and security-relevant relationships, potentially expanding access across users and manipulating workflows. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-61653 is a high-severity SQL injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw exists in the Campaigns module where user input is improperly handled, allowing an authenticated user with Campaigns access to perform time-based blind SQL injection attacks. This issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-63213 is a path traversal vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw exists in the Upgrade Wizard commit flow where the hidden zip_to_dir parameter is trusted, and the clean_path() function fails to reject directory traversal sequences. An authenticated administrator can exploit this to copy files outside the intended directory, potentially overwriting application or configuration files, placing executable PHP files under the web root, or causing denial of service. The vulnerability is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a server-side request forgery (SSRF) vulnerability due to improper hostname validation. The SSRF protection implemented in version 7.15.1 uses substring comparison instead of strict hostname equality, allowing an authenticated attacker to bypass IP validation by placing the server hostname in a URL path. This enables the attacker to direct server-side requests to internal services. The issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM versions prior to 7.15.2 and between 8.0.0 and before 8.10.2 contain a time-based blind SQL injection vulnerability in the REST API v4.1 get_entry_list method. This vulnerability requires an authenticated user to bypass two unspecified security mechanisms simultaneously. Successful exploitation can lead to extraction of sensitive database information. The issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-63217 is an authorization bypass vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability allows any authenticated user to read fields from records they should not have access to due to improper access control checks in the generatePdf entry point. This flaw arises because the generatePdf function loads records via BeanFactory::getBean() without verifying the requesting user's permissions, exposing sensitive contact, financial, deal, and custom-field data. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-63214 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The issue arises from legacy REST methods that append an authenticated user's query parameter directly into a SQL WHERE clause without sufficient validation. Exploitation requires an account with list permission on a module and can lead to bypassing user_hash filters, allowing attackers to retrieve password hashes and other sensitive database data. This can result in administrative credential compromise and full application takeover. The vulnerability is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The affected flow begins at AOR_Reports and uses changeReportPage, and DetailView to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can directly invoke the action and read report rows and restricted-module data despite owner-only or role-based report visibility. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-61651 is a high-severity SQL injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability exists in the get_end_date action of the Projects Controller, where a low-privileged authenticated user can inject SQL via the task_id parameter due to lack of query parameterization. This flaw allows blind SQL injection attacks that can enumerate the database schema and extract sensitive data such as credentials and customer records. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-63111 is a missing authorization vulnerability in SuiteCRM's V8 module API prior to versions 7.15.2 and 8.10.2. It allows low-privileged users to create SchedulerJobs with attacker-controlled target values that are executed with system privileges. This can lead to server-side requests to internal or external hosts, potentially exposing internal services. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-32697 is an authorization bypass vulnerability in SuiteCRM-Core versions prior to 8.9.3. The vulnerability arises because the getRecord() method does not verify user permissions before retrieving records, allowing users with limited privileges to access sensitive data they should not view. Although the saveRecord() method correctly enforces access control, the missing ACL check in getRecord() leads to a confidentiality breach. This flaw has a CVSS score of 6.5, indicating medium severity, and does not require user interaction but does require some level of privileges. The issue was patched in version 8.9.3.
CVE-2026-29109 is a high-severity deserialization vulnerability in SuiteCRM versions prior to 8.9.3. It affects the SavedSearch filter processing component, where the application unserializes user-controlled data without restricting allowed classes. This flaw allows an authenticated administrator to execute arbitrary system commands on the server, potentially leading to full system compromise. The vulnerability arises from unsafe use of PHP's unserialize() function on data from the saved_search.contents database column. No user interaction beyond authentication is required, and the vulnerability does not require network-level access beyond normal admin privileges. Although no exploits are currently known in the wild, the risk is significant due to the potential impact and ease of exploitation by privileged users. Organizations using SuiteCRM versions before 8.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As any authenticated user can query this endpoint, it's possible to retrieve and potentially crack the passwords of administrative users. Version 8.9.3 patches the issue.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column names, extract sensitive data, or escalate privileges. This is fixed in version 8.9.1.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.