CVE-2026-100358 is a critical code injection vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. The Studio Dropdown Editor improperly processes input by passing $dropdown_name through html_entity_decode() and writing it directly into a PHP language file under custom/. This allows an administrator to inject persistent PHP code that executes with the web-server account, compromising the confidentiality, integrity, and availability of the application and host. The vulnerability is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM versions prior to 7.15.2 and 8.10.2 contain an improper privilege management vulnerability in the V8 module API. This flaw allows any authenticated OAuth2 user with low privileges to perform CRUD operations on administrator-only modules. Exploiting this, an attacker can create roles, modify access control levels, assign elevated roles, and change global configurations, effectively gaining administrator-level control over CRM data and behavior. The issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-100359 is a SQL Injection vulnerability in SuiteCRM's Project Template module affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability arises from unsanitized, unauthenticated user input in the action_get_end_date function, allowing authenticated users to perform blind SQL injection attacks. This can lead to unauthorized reading of sensitive database contents such as customer data, internal communications, and credentials. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM versions prior to 7.15.2 and 8.10.2 have a vulnerability in the /legacy/Api/V8/OAuth2 password-grant endpoint where distinct error messages are returned for invalid usernames versus invalid passwords. This allows unauthenticated attackers to enumerate valid usernames, facilitating targeted attacks such as password spraying and credential stuffing. The issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-100361 is a vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It involves improper control over modification of dynamically-determined object attributes in the V8 API write path. Authenticated users can exploit this flaw to mass-assign internal authentication fields, modify password hashes, or change external authentication flags, leading to unauthorized account access.
CVE-2026-100364 is a high-severity authorization bypass vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. The flaw occurs in the V8 JSON:API update path where the id attribute is not removed before user-supplied attributes are assigned to a SugarBean object. This allows an authenticated user to substitute another record's identifier, bypass owner-only authorization controls, overwrite that record, and hijack its ownership. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-71548 is a high-severity SQL injection vulnerability in SuiteCRM versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. It arises from improper input validation in the AOR_Report::build_report_query_where function, allowing authenticated users with report-saving privileges to read the entire SuiteCRM database. Sensitive data such as user hashes, OAuth2 tokens, CRM records, and configuration data may be exposed. The vulnerability does not support stacked queries, so direct data modification via injection is not possible. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-71550 is a critical remote file inclusion vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It arises from the workflow controller using an attacker-controllable parameter in a require_once() call without proper validation, allowing authenticated users with the WorkFlow role to execute arbitrary PHP code on the server. This can lead to full server compromise, unauthorized access to CRM data and configuration secrets, and persistent unauthorized access. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69134 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and 8.10.2. It involves the REST v4 JSON handler improperly handling the RAW_REQUEST value and relationship write helpers, allowing an authenticated user to inject SQL via relationship fields. This can lead to unauthorized reading or modification of database data and potentially file-write operations if the database account has elevated privileges. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-69142 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and from 8.0.0 up to but not including 8.10.2. The vulnerability exists in the jjwg_Maps map marker endpoint, where the authenticated user's distance parameter is not strictly validated or parameterized, allowing SQL query manipulation. This flaw enables an authenticated attacker to extract database data, modify query results, and consume system resources. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69140 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw arises from unsafe interpolation of user input into an SQL UPDATE statement in GetLatestRevision.php. A low-privileged user with access to the Documents module can exploit this to disclose database data and mass-update linked_documents records. The vulnerability does not support stacked statements or arbitrary DROP/INSERT commands. It is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69145 is a SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The issue arises because the AOR report generation reloads and concatenates values from aor_fields.field into SQL queries without strict validation. Authenticated users with report configuration privileges can exploit this to inject SQL and disclose database contents. The vulnerability is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69136 is a SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw arises from insecure handling of the remove_attachment POST parameter array in email template attachment processing, allowing an authenticated attacker to inject SQL commands. This can lead to disclosure of database information or soft deletion of all records in the notes table. The vulnerability is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-69135 is a SQL Injection vulnerability in SuiteCRM's Project module affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability arises because the duplicateId POST parameter is directly interpolated into a SQL query without proper sanitization or parameterization. An authenticated attacker can exploit this flaw to alter the query structure and potentially disclose sensitive database information. This issue has been fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69144 is an authorization bypass vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It allows a low-privileged authenticated user to download protected documents by exploiting an identifier confusion in the download.php script, where document revision UUIDs are served without proper authorization checks on the parent document. This issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69137 is a Server-Side Request Forgery (SSRF) vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability arises because the CalendarAccount testConnection action passes an authenticated user's server_url directly to curl without validating the host, address, or scheme. This allows an attacker to cause the server to send crafted PROPFIND requests from its network context, potentially accessing internal services, disclosing partial responses, enumerating services, and possibly accessing cloud metadata. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.