SQL Injection Vulnerability in SuiteCRM's Project Template Module
CVE-2026-100359

6.5MEDIUM

Key Information:

Vendor

Suitecrm

Status
Suitecrm
Vendor
CVE Published:
5 November 2026

What is CVE-2026-100359?

An SQL injection vulnerability exists in the Project Template module of SuiteCRM, where the action_get_end_date function fails to properly sanitize user inputs for task_id and lag parameters. Authenticated users can exploit this flaw to perform blind SQL injection attacks, potentially exposing sensitive customer data, internal communications, and user credentials. The vulnerability is addressed in SuiteCRM versions 7.15.2 and 8.10.2, making it crucial for users to upgrade to these versions to ensure the security of their systems.

Affected Version(s)

SuiteCRM < 7.15.2 < 7.15.2

SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/...
x_refsource_CONFIRM
https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f5018...
x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159e...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.