Cross-Site Scripting in SuiteCRM: Open-Source CRM Software Vulnerability
CVE-2026-29106

5.9MEDIUM

Key Information:

Vendor

Suitecrm

Status
Suitecrm
Vendor
CVE Published:
19 March 2026

What is CVE-2026-29106?

SuiteCRM, an open-source customer relationship management platform, is susceptible to a Cross-Site Scripting (XSS) vulnerability wherein the return_id request parameter is improperly handled. Specifically, prior to versions 7.15.1 and 8.9.3, this parameter is directly incorporated into an HTML tag attribute that acts as an event handler, enabling potential exploitation by attackers. It's crucial for users to upgrade to fixed versions and implement a Content Security Policy (CSP) header to effectively safeguard against XSS attacks.

Affected Version(s)

SuiteCRM < 7.15.1 < 7.15.1

SuiteCRM >= 8.0.0, < 8.9.3 < 8.0.0, 8.9.3

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/...
x_refsource_CONFIRM
https://docs.suitecrm.com/admin/releases/7.15.x
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.