SQL Injection Vulnerability in SuiteCRM by SuiteCRM Team
CVE-2026-63214
What is CVE-2026-63214?
SuiteCRM, a widely-used open-source CRM application, is susceptible to SQL injection through its legacy REST methods. In versions prior to 7.15.2 and 8.10.2, the vulnerability arises when an attacker can manipulate query parameters due to inadequate validation. This flaw allows authenticated users with list permissions on specific modules to bypass security filters, potentially leading to the exposure of sensitive data such as password hashes and administrative credentials. The issue can be exploited through the affected REST API endpoints, enabling unauthorized access to critical application data. Users are strongly advised to update to the patched versions to safeguard their CRM systems.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2