SB2026080113 - Multiple vulnerabilities in SuiteCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080113

SB2026080113 - Multiple vulnerabilities in SuiteCRM

Published: August 1, 2026 Updated: August 19, 2026

Security Bulletin ID SB2026080113
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 23
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 61% Low 39%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 23 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2026-69145)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the AOR Reports report SQL construction logic when viewing a report containing a crafted aor_fields.field value. A remote user can create or edit a report to store a malicious field value and trigger SQL execution to disclose sensitive information.

Exploitation requires permission to create or edit AOR Reports.


2) PHP file inclusion (CVE-ID: CVE-2026-71550)

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of filename for include/require statement in modules/AOW_WorkFlow/controller.php when processing the aow_action GET parameter. A remote user can inject path traversal sequences to execute arbitrary code.

Exploitation requires a single authenticated session with the WorkFlow role with AOW_WorkFlow access enabled and does not require administrative privileges.


3) SQL injection (CVE-ID: CVE-2026-71548)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the AOR_Reports module `AOR_Report::build_report_query_where` when processing the `parameter_value` field with `value_type=Field`. A remote user can save a report with a specially crafted `parameter_value` to disclose sensitive information.

Exploitation requires an authenticated session with permission to save a report, including non-admin users with the default role assignment.


4) SQL injection (CVE-ID: CVE-2026-69134)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the REST v4 API relationship management handler when processing crafted relationship field values from rest_data. A remote user can send a specially crafted API request to execute arbitrary SQL commands.

The issue arises because request data is read from an unsanitized copy of user input before the securexss() filter runs, and affects methods receiving rest_data, including set_relationship.


5) SQL injection (CVE-ID: CVE-2026-69135)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to sql injection in the Project module Save.php endpoint when processing the duplicateId POST parameter. A remote user can send a specially crafted request to disclose sensitive information.

The issue can be exploited through blind time-based SQL injection.


6) SQL injection (CVE-ID: CVE-2026-69136)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the handleAttachments function when processing the remove_attachment POST parameter array. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue can be exploited through the EmailTemplates Save endpoint, and no administrative rights are required.


7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-69137)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to make server-side requests to arbitrary hosts and disclose partial response data.

The vulnerability exists due to server-side request forgery in the CalendarAccount::action_testConnection endpoint when processing a user-supplied server_url parameter. A remote user can supply an arbitrary URL to make server-side requests to arbitrary hosts and disclose partial response data.

The server issues a PROPFIND request from its own network context, which can expose internal services through error responses when non-2xx responses are returned.


8) SQL injection (CVE-ID: CVE-2026-69142)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the `jjwg_Maps` map marker endpoint when handling the `distance` request parameter. A remote user can send a specially crafted request to execute arbitrary SQL commands.

The `distance` parameter is inserted into a SQL expression without numeric validation or parameterization.


9) SQL injection (CVE-ID: CVE-2026-69140)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information, modify database records, and cause a denial of service.

The vulnerability exists due to SQL injection in modules/Documents/GetLatestRevision.php when handling the get_latest_for_id parameter. A remote user can send a specially crafted request to disclose sensitive information, modify database records, and cause a denial of service.

The issue arises because the get_latest_for_id parameter is interpolated directly into an SQL UPDATE statement without parameterization, and the input filtering can be bypassed by prepending an XSS payload that allows a literal single quote to reach the database.


10) SQL injection (CVE-ID: CVE-2026-69141)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the action_get_kb_articles action in modules/Cases/controller.php when processing the search parameter in POST requests. A remote user can send a specially crafted search parameter to disclose sensitive information.

The issue can be exploited for time-based blind SQL injection, and access to the Cases module is required.


11) SQL injection (CVE-ID: CVE-2026-69143)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL queries.

The vulnerability exists due to SQL injection in the get_kb_articles action in CasesController when processing the search parameter. A remote user can send a specially crafted search parameter to execute arbitrary SQL queries.

The issue is exploitable as a time-based blind SQL injection.


12) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-69144)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in download.php when handling document download requests with a document revision identifier supplied as a document identifier. A remote user can supply a document revision identifier with type=Documents to disclose sensitive information.

The issue occurs because access control is checked against an empty Documents bean before the revision is resolved, and access is not re-checked against the parent document.


13) Incorrect authorization (CVE-ID: CVE-2026-63218)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the AOR_Reports changeReportPage controller action when handling direct calls to non-view controller actions for protected records. A remote user can send a direct request to changeReportPage to disclose sensitive information.

DetailView correctly denies access, but changeReportPage renders the full report body and row data without a per-record ACL check.


14) Path traversal (CVE-ID: CVE-2026-63213)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write arbitrary files and execute arbitrary code.

The vulnerability exists due to path traversal in the Upgrade Wizard commit flow when processing a tampered final install request containing the hidden zip_to_dir parameter. A remote privileged user can modify the zip_to_dir parameter to copy extracted package files to an attacker-chosen path outside the intended upgrade destination to write arbitrary files and execute arbitrary code.

The issue is limited to the Upgrade Wizard commit phase and can also be used to overwrite application files or corrupt configuration and code files.


15) SQL injection (CVE-ID: CVE-2026-63214)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and compromise the platform.

The vulnerability exists due to SQL injection in the legacy REST API /service/v4_1/rest.php when processing a crafted query parameter in methods such as get_entry_list and get_entries_count. A remote user can supply a crafted query parameter to disclose sensitive information and compromise the platform.

Exploitation requires a valid SuiteCRM user account and list ACL permission on at least one module.


16) SQL injection (CVE-ID: CVE-2026-63215)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the REST API v4.1 get_entry_list method when handling crafted requests to /service/v4_1/rest.php. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue is time-based blind and requires authenticated access.


17) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-63111)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to missing authorization in the SchedulersJobs REST API and SchedulersJob bean when creating SchedulersJobs records with an arbitrary target value. A remote user can create a crafted SchedulersJobs record with a url:: target to perform server-side request forgery.

The injected job is executed by cron.php under the system admin user context, which can allow access to internal network hosts, localhost services, and cloud metadata endpoints. Injected jobs may also persist in the job queue and be configured with recurring schedules.


18) SQL injection (CVE-ID: CVE-2026-61648)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to SQL injection in modules/AOR_Reports/AOR_Report.php when processing the parameter_value[0] request parameter for user-controllable Multi report conditions. A remote user can send a specially crafted request to disclose sensitive information and cause a denial of service.

The issue is exploitable through time-based blind and UNION-based SELECT injection.


19) SQL injection (CVE-ID: CVE-2026-61653)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in modules/Campaigns/PopupCampaignRoi.php when handling the $_REQUEST['id'] parameter. A remote user can send a specially crafted request to disclose sensitive information.

The issue can be exploited through time-based blind SQL injection, and access to the Campaigns module is required.


20) SQL injection (CVE-ID: CVE-2026-61651)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the get_end_date action in Projects Controller when handling the task_id parameter. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue may be exploited using blind SQL injection techniques to enumerate database schema and dump database contents.


21) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-61649)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to access internal services via server-side request forgery.

The vulnerability exists due to improper restriction of outbound requests in isSelfRequest() when validating external hosts. A remote user can supply a crafted URL containing the server hostname in the path component to access internal services via server-side request forgery.

This issue is caused by substring matching with stripos() instead of hostname equality, which allows bypass of IP validation.


22) Missing Authorization (CVE-ID: CVE-2026-61650)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify security-relevant relationships and ownership fields on records they should not be able to edit.

The vulnerability exists due to missing authorization in the V8 relationship creation endpoint when handling POST requests to create one-to-many relationships. A remote user can send a specially crafted relationship creation request to modify security-relevant relationships and ownership fields on records they should not be able to edit.

For one-to-many relationships, creating the relationship writes the right-hand-side foreign key into the target record, turning a read-only relationship action into an unauthorized record modification.


23) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-63217)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the generatePdf entry point when loading records by user-supplied identifiers. A remote user can request a record they are not authorized to access to disclose sensitive information.

The issue bypasses role-based access control for data reads and can expose all field values from records across any module, including custom fields.


Remediation

Install update from vendor's website.

References