SQL Injection Vulnerability in SuiteCRM Product by SuiteCRM
CVE-2026-69134
8.8HIGH
What is CVE-2026-69134?
SuiteCRM, a popular open-source CRM solution, was found to be vulnerable to SQL injection due to improper handling of user input in its REST v4 JSON handler. Specifically, the software allowed authenticated users to manipulate the RAW_REQUEST value, leading to unauthorized SQL commands being executed. This vulnerability could allow attackers to gain access to or modify database information, especially if the underlying database account had elevated privileges. The issue has been addressed in updates 7.15.2 and 8.10.2, and users are encouraged to upgrade to protect their data.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2