SQL Injection Vulnerability in SuiteCRM Affects Multiple Versions
CVE-2026-69141
8.3HIGH
What is CVE-2026-69141?
SuiteCRM, an open-source CRM application, has a vulnerability within the CasesController action_get_kb_articles. This issue arises when user input from the $_POST['search'] variable is improperly handled in an SQL statement, specifically through interpolation in a CASE WHEN ... LIKE expression in the WHERE clause. A low-privileged user with access to the Cases module can exploit this flaw to perform blind SQL injection attacks, potentially exposing sensitive information from the database. The vulnerability has been addressed and resolved in versions 7.15.2 and 8.10.2 of SuiteCRM.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2