PT-2026-26437 · Suitecrm · Suitecrm

Jbince · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-29099

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the retrieve() function in include/OutboundEmail/OutboundEmail.php fails to properly neutralize the user controlled $id parameter. It is assumed that the function calling retrieve() will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the EmailUIAjax action on the Email() module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the retrieve() function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-29099

Affected Products

Suitecrm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-29099 · Security Note
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-38rf-h37x-7767 · Note
• https://twitter.com/TheHackerWire/status/2034781921755242655 · Twitter Post
• https://twitter.com/CveFindCom/status/2034777656869175779 · Twitter Post
• https://docs.suitecrm.com/admin/releases/7.15.x · Note