SQL Injection Vulnerability in SuiteCRM Software by SalesAgility
CVE-2026-71548

8.8HIGH

Key Information:

Vendor

Suitecrm

Status
Suitecrm
Vendor
CVE Published:
5 November 2026

What is CVE-2026-71548?

SuiteCRM, an open-source customer relationship management application, features a vulnerability that allows authenticated users to exploit insufficient validation in the AOR_Report::build_report_query_where function. This flaw permits SQL injection attacks that could expose sensitive database information such as user credentials, OAuth2 tokens, and other critical CRM data. The vulnerability is mitigated in versions 7.15.2 and 8.10.2, emphasizing the importance of maintaining up-to-date software to safeguard against potential data breaches.

Affected Version(s)

SuiteCRM < 7.15.2 < 7.15.2

SuiteCRM >= 8.0.0, < 8.10.2 < 8.0.0, 8.10.2

References

https://github.com/SuiteCRM/SuiteCRM/security/advisories/...
x_refsource_CONFIRM
https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f5018...
x_refsource_MISC
https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159e...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.