SQL Injection Vulnerability in SuiteCRM Affected by User-Controlled Conditions

CVE-2026-61648

What is CVE-2026-61648?

SuiteCRM, an open-source Customer Relationship Management software, is susceptible to a SQL injection vulnerability due to improper handling of user-controlled multi-report conditions. Specifically, prior to versions 7.15.2 and 8.10.2, the application processes parameter values in a way that allows malicious actors to manipulate SQL queries through crafted input. This flaw can be exploited by low-privileged users with access to AOR Reports, enabling them to read arbitrary database tables using techniques such as time-based or UNION-based SQL injections. The vulnerability is mitigated in the updated versions 7.15.2 and 8.10.2.

References