SQL Injection Vulnerability in SuiteCRM by SuiteCRM Inc.
CVE-2026-61653
8.3HIGH
What is CVE-2026-61653?
SuiteCRM, a widely used open-source CRM solution, is affected by a notable SQL injection vulnerability. This issue arises in the Campaigns module where user input from the $_REQUEST['id'] variable is improperly handled. An attacker with authenticated access can exploit this vulnerability to execute time-based blind SQL injections against arbitrary database tables, leading to unauthorized data exposure or manipulation. To mitigate the risk, users are strongly advised to upgrade to versions 7.15.2 or 8.10.2, where the vulnerability has been addressed.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2