PT-2026-26444 · Suitecrm · Suitecrm

Yamerooo123 · Published 2026-03-19 · Updated 2026-03-19 · CVE-2026-29106

Mitre

CVSS v3.1

5.9

Medium

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the return id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double quotation marks. Versions 7.15.1 and 8.9.3 patch the issue. Users should also use a Content Security Policy (CSP) header to completely mitigate XSS.

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-159

CWE-116

CWE-79

CWE-80

Related Identifiers

CVE-2026-29106

Affected Products

Suitecrm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-29106 · Security Note
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-7qrj-5hj6-7c2m · Note
• https://docs.suitecrm.com/admin/releases/7.15.x · Note