SQL Injection in SuiteCRM Authentication Mechanism

CVE-2026-33288

What is CVE-2026-33288?

SuiteCRM, a widely-used open-source Customer Relationship Management software, is vulnerable to a SQL Injection flaw found in its authentication mechanisms when directory support is enabled. This vulnerability arises because the application does not adequately sanitize the username input from users, allowing an attacker with minimal directory credentials to inject and execute arbitrary SQL commands. This could potentially lead to severe consequences, including unauthorized access to CRM administrator privileges. It is crucial for users to update to SuiteCRM versions 7.15.1 or 8.9.3, where this vulnerability has been resolved.

References