SB2026080113 - Multiple vulnerabilities in SuiteCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080113

SB2026080113 - Multiple vulnerabilities in SuiteCRM

Published: August 1, 2026 Updated: November 9, 2026

Security Bulletin ID SB2026080113
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 32
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 56% Low 44%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 32 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2026-69142)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the `jjwg_Maps` map marker endpoint when handling the `distance` request parameter. A remote user can send a specially crafted request to execute arbitrary SQL commands.

The `distance` parameter is inserted into a SQL expression without numeric validation or parameterization.


2) SQL injection (CVE-ID: CVE-2026-100365)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker with access to SuiteCRM's AOR_Reports to exfiltrate database contents, including administrator password hashes.

The vulnerability exists due to insufficient validation of attacker-controlled field labels incorporated into the ORDER BY clause when AOR_Reports queries execute. A low-privileged authenticated attacker can submit a malicious field label and use automated time-based probes to extract a complete administrator password hash.


3) SQL injection (CVE-ID: CVE-2026-100359)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to extract sensitive information from the SuiteCRM database, including customer data and administrator credentials.

The vulnerability exists due to direct interpolation of user-supplied task_id and lag POST parameters into a SQL query in the Project Template module's action_get_end_date function. A low-privileged authenticated attacker can submit crafted requests to enumerate database contents without administrative rights or victim interaction.


4) SQL injection (CVE-ID: CVE-2026-97377)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to extract database information through blind SQL injection in SuiteCRM's portal API.

The vulnerability exists due to insufficient sanitization of the where and order_by inputs when the legacy SOAP method portal_get_entry_list constructs SQL queries. A low-privileged remote attacker can submit crafted SQL expressions through an authenticated portal API context to extract database metadata using boolean-based queries.


5) Code Injection (CVE-ID: CVE-2026-100358)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an administrator to achieve persistent operating system code execution as the www-data user on the SuiteCRM server.

The vulnerability exists due to unsafe handling of dropdown names in the Studio Dropdown Editor, which writes attacker-controlled content into a PHP language file loaded on subsequent page requests. An administrator can submit a malicious dropdown name to install a persistent webshell that permits subsequent unauthenticated command execution.


6) Observable Response Discrepancy (CVE-ID: CVE-2026-100362)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to enumerate valid SuiteCRM usernames on instances exposing the OAuth2 endpoint.

The vulnerability exists due to distinct authentication error messages for invalid usernames and invalid passwords when processing password-grant requests at the V8 OAuth2 endpoint. An unauthenticated remote attacker can submit candidate usernames to /legacy/Api/V8/OAuth2 and compare errors to identify existing CRM accounts without victim interaction.


7) Missing Authorization (CVE-ID: CVE-2026-100363)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges to administrator-equivalent control of the CRM and its data.

The vulnerability exists due to missing authorization in the SuiteCRM V8 REST API for the ACLRoles, ACLActions, and Administration modules when handling module and relationship requests. A remote user can create roles, modify ACL access levels, and bind a role to their own account to escalate privileges to administrator-equivalent control of the CRM and its data.

Exploitation requires the V8 API to be enabled and a valid OAuth2 token for the user's account.


8) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-100361)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify sensitive user authentication fields.

The vulnerability exists due to mass assignment in the SuiteCRM V8 REST API write path when processing module update requests without enforcing field visibility and sensitivity restrictions. A remote user can send PATCH requests to /Api/V8/module containing user_hash or external_auth_only attributes to modify sensitive user authentication fields.

The API read path suppresses these fields from responses.


9) Missing Authorization (CVE-ID: CVE-2026-100360)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify protected record relationships without the required authorization.

The vulnerability exists due to missing object-level authorization in V8 API relationship operations when handling relationship creation and deletion requests. A remote user can create Account-to-Contact relationships without permission to edit the Account or delete relationships to Contacts they cannot view to modify protected record relationships without the required authorization.


10) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-100364)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass access controls, overwrite CRM records, and hijack record ownership.

The vulnerability exists due to missing filtering of the user-controlled id attribute in the V8 JSON:API processAttributes() function when processing user-supplied attributes for the updateRecord() endpoint before passing them to SugarBean. A remote user can inject a victim record's ID into the attributes payload to bypass access controls, overwrite CRM records, and hijack record ownership.


11) PHP file inclusion (CVE-ID: CVE-2026-71550)

CWE-ID: CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of filename for include/require statement in modules/AOW_WorkFlow/controller.php when processing the aow_action GET parameter. A remote user can inject path traversal sequences to execute arbitrary code.

Exploitation requires a single authenticated session with the WorkFlow role with AOW_WorkFlow access enabled and does not require administrative privileges.


12) SQL injection (CVE-ID: CVE-2026-71548)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the AOR_Reports module `AOR_Report::build_report_query_where` when processing the `parameter_value` field with `value_type=Field`. A remote user can save a report with a specially crafted `parameter_value` to disclose sensitive information.

Exploitation requires an authenticated session with permission to save a report, including non-admin users with the default role assignment.


13) SQL injection (CVE-ID: CVE-2026-69134)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the REST v4 API relationship management handler when processing crafted relationship field values from rest_data. A remote user can send a specially crafted API request to execute arbitrary SQL commands.

The issue arises because request data is read from an unsanitized copy of user input before the securexss() filter runs, and affects methods receiving rest_data, including set_relationship.


14) SQL injection (CVE-ID: CVE-2026-69135)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to sql injection in the Project module Save.php endpoint when processing the duplicateId POST parameter. A remote user can send a specially crafted request to disclose sensitive information.

The issue can be exploited through blind time-based SQL injection.


15) SQL injection (CVE-ID: CVE-2026-69136)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the handleAttachments function when processing the remove_attachment POST parameter array. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue can be exploited through the EmailTemplates Save endpoint, and no administrative rights are required.


16) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-69137)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to make server-side requests to arbitrary hosts and disclose partial response data.

The vulnerability exists due to server-side request forgery in the CalendarAccount::action_testConnection endpoint when processing a user-supplied server_url parameter. A remote user can supply an arbitrary URL to make server-side requests to arbitrary hosts and disclose partial response data.

The server issues a PROPFIND request from its own network context, which can expose internal services through error responses when non-2xx responses are returned.


17) Incorrect authorization (CVE-ID: CVE-2026-63218)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the AOR_Reports changeReportPage controller action when handling direct calls to non-view controller actions for protected records. A remote user can send a direct request to changeReportPage to disclose sensitive information.

DetailView correctly denies access, but changeReportPage renders the full report body and row data without a per-record ACL check.


18) SQL injection (CVE-ID: CVE-2026-69140)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information, modify database records, and cause a denial of service.

The vulnerability exists due to SQL injection in modules/Documents/GetLatestRevision.php when handling the get_latest_for_id parameter. A remote user can send a specially crafted request to disclose sensitive information, modify database records, and cause a denial of service.

The issue arises because the get_latest_for_id parameter is interpolated directly into an SQL UPDATE statement without parameterization, and the input filtering can be bypassed by prepending an XSS payload that allows a literal single quote to reach the database.


19) SQL injection (CVE-ID: CVE-2026-69141)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the action_get_kb_articles action in modules/Cases/controller.php when processing the search parameter in POST requests. A remote user can send a specially crafted search parameter to disclose sensitive information.

The issue can be exploited for time-based blind SQL injection, and access to the Cases module is required.


20) SQL injection (CVE-ID: CVE-2026-69143)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL queries.

The vulnerability exists due to SQL injection in the get_kb_articles action in CasesController when processing the search parameter. A remote user can send a specially crafted search parameter to execute arbitrary SQL queries.

The issue is exploitable as a time-based blind SQL injection.


21) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-69144)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through a user-controlled key in download.php when handling document download requests with a document revision identifier supplied as a document identifier. A remote user can supply a document revision identifier with type=Documents to disclose sensitive information.

The issue occurs because access control is checked against an empty Documents bean before the revision is resolved, and access is not re-checked against the parent document.


22) SQL injection (CVE-ID: CVE-2026-69145)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the AOR Reports report SQL construction logic when viewing a report containing a crafted aor_fields.field value. A remote user can create or edit a report to store a malicious field value and trigger SQL execution to disclose sensitive information.

Exploitation requires permission to create or edit AOR Reports.


23) Path traversal (CVE-ID: CVE-2026-63213)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write arbitrary files and execute arbitrary code.

The vulnerability exists due to path traversal in the Upgrade Wizard commit flow when processing a tampered final install request containing the hidden zip_to_dir parameter. A remote privileged user can modify the zip_to_dir parameter to copy extracted package files to an attacker-chosen path outside the intended upgrade destination to write arbitrary files and execute arbitrary code.

The issue is limited to the Upgrade Wizard commit phase and can also be used to overwrite application files or corrupt configuration and code files.


24) SQL injection (CVE-ID: CVE-2026-63214)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and compromise the platform.

The vulnerability exists due to SQL injection in the legacy REST API /service/v4_1/rest.php when processing a crafted query parameter in methods such as get_entry_list and get_entries_count. A remote user can supply a crafted query parameter to disclose sensitive information and compromise the platform.

Exploitation requires a valid SuiteCRM user account and list ACL permission on at least one module.


25) SQL injection (CVE-ID: CVE-2026-63215)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the REST API v4.1 get_entry_list method when handling crafted requests to /service/v4_1/rest.php. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue is time-based blind and requires authenticated access.


26) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-63111)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to missing authorization in the SchedulersJobs REST API and SchedulersJob bean when creating SchedulersJobs records with an arbitrary target value. A remote user can create a crafted SchedulersJobs record with a url:: target to perform server-side request forgery.

The injected job is executed by cron.php under the system admin user context, which can allow access to internal network hosts, localhost services, and cloud metadata endpoints. Injected jobs may also persist in the job queue and be configured with recurring schedules.


27) SQL injection (CVE-ID: CVE-2026-61648)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to SQL injection in modules/AOR_Reports/AOR_Report.php when processing the parameter_value[0] request parameter for user-controllable Multi report conditions. A remote user can send a specially crafted request to disclose sensitive information and cause a denial of service.

The issue is exploitable through time-based blind and UNION-based SELECT injection.


28) SQL injection (CVE-ID: CVE-2026-61653)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in modules/Campaigns/PopupCampaignRoi.php when handling the $_REQUEST['id'] parameter. A remote user can send a specially crafted request to disclose sensitive information.

The issue can be exploited through time-based blind SQL injection, and access to the Campaigns module is required.


29) SQL injection (CVE-ID: CVE-2026-61651)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the get_end_date action in Projects Controller when handling the task_id parameter. A remote user can send a specially crafted request to disclose sensitive information and modify data.

The issue may be exploited using blind SQL injection techniques to enumerate database schema and dump database contents.


30) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-61649)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to access internal services via server-side request forgery.

The vulnerability exists due to improper restriction of outbound requests in isSelfRequest() when validating external hosts. A remote user can supply a crafted URL containing the server hostname in the path component to access internal services via server-side request forgery.

This issue is caused by substring matching with stripos() instead of hostname equality, which allows bypass of IP validation.


31) Missing Authorization (CVE-ID: CVE-2026-61650)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify security-relevant relationships and ownership fields on records they should not be able to edit.

The vulnerability exists due to missing authorization in the V8 relationship creation endpoint when handling POST requests to create one-to-many relationships. A remote user can send a specially crafted relationship creation request to modify security-relevant relationships and ownership fields on records they should not be able to edit.

For one-to-many relationships, creating the relationship writes the right-hand-side foreign key into the target record, turning a read-only relationship action into an unauthorized record modification.


32) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-63217)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the generatePdf entry point when loading records by user-supplied identifiers. A remote user can request a record they are not authorized to access to disclose sensitive information.

The issue bypasses role-based access control for data reads and can expose all field values from records across any module, including custom fields.


Remediation

Install update from vendor's website.

References