LDAP Injection Vulnerability in SuiteCRM by SuiteCRM

CVE-2026-33289

What is CVE-2026-33289?

SuiteCRM, an open-source CRM software, has an LDAP Injection vulnerability found in its authentication flow prior to versions 7.15.1 and 8.9.3. This security flaw results from inadequate sanitization of user inputs, allowing attackers to inject LDAP control characters into search filters. Consequently, malicious actors could manipulate query logic, potentially leading to unauthorized access or exposure of sensitive information. Users are recommended to upgrade to patched versions to mitigate such risks.

References