PT-2026-26430 · Suitecrm · Suitecrm

Q1Uf3Ng · Published 2026-03-19 · Updated 2026-03-25 · CVE-2026-29096

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the field function parameter received through POST data in the AOR Reports module is saved directly into the aor fields table without validation. Subsequently, when a report is executed or viewed, this value is directly concatenated into a SQL SELECT query without sanitization, leading to a second-order SQL injection. An authenticated user with Reports access can potentially extract arbitrary database contents, including password hashes, API tokens, and configuration values. In MySQL environments with FILE privilege, Remote Code Execution (RCE) may be possible through SELECT INTO OUTFILE.

Recommendations SuiteCRM versions prior to 7.15.1 should be updated to version 7.15.1 or later. SuiteCRM versions prior to 8.9.3 should be updated to version 8.9.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-29096

Affected Products

Suitecrm

References · 7

• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-vh42-gmqm-q55m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29096 · Security Note
• https://twitter.com/CVEnew/status/2034841522227875931 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034842832628834795 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034778671643599310 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://docs.suitecrm.com/admin/releases/7.15.x · Note