SQL Injection Vulnerability in SuiteCRM from SalesAgility
CVE-2026-69140
8.3HIGH
What is CVE-2026-69140?
A vulnerability exists in SuiteCRM where the GetLatestRevision.php script improperly processes user input in an SQL UPDATE statement. This flaw allows a low-privileged user, with access to the Documents module, to potentially disclose sensitive database information and update linked documents records. The issue arises due to a failure in correctly encoding input, allowing an XSS payload to bypass security measures. This vulnerability has been effectively addressed in versions 7.15.2 and 8.10.2, so users are recommended to update immediately.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2