PT-2026-26443 · Suitecrm · Suitecrm

D3Dn0V4 · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-29105

NVD

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains an unauthenticated open redirect vulnerability in the WebToLead capture functionality. A user-supplied POST parameter is used as a redirect destination without validation, allowing attackers to redirect victims to arbitrary external websites. This vulnerability allows attackers to abuse the trusted SuiteCRM domain for phishing and social engineering attacks by redirecting users to malicious external websites. Versions 7.15.1 and 8.9.3 patch the issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-29105

Affected Products

Suitecrm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-29105 · Security Note
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-9crg-83cg-wv74 · Note
• https://docs.suitecrm.com/admin/releases/7.15.x · Note