SQL Injection Vulnerability in SuiteCRM Affecting Multiple Versions
CVE-2026-69145
6.5MEDIUM
What is CVE-2026-69145?
SuiteCRM, an open-source Customer Relationship Management software, is susceptible to SQL injection due to improper validation when generating AOR reports. An authenticated user with the ability to configure reports can exploit this vulnerability by manipulating the aor_fields.field value, leading to the execution of arbitrary SQL commands and disclosure of sensitive database information. This vulnerability exists in versions prior to 7.15.2 and 8.10.2, which implement strict field validation to mitigate such risks.
Affected Version(s)
SuiteCRM < 7.15.2 < 7.15.2
SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2