LDAP injection in SuiteCRM - CVE-2026-33289
Published: April 24, 2026
Vulnerability identifier: #VU127399
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33289
CWE-ID: CWE-90
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authentication or disclose sensitive information.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the authentication flow when processing user-supplied input in an LDAP search filter. A remote user can inject LDAP control characters to bypass authentication or disclose sensitive information.
Affected software
SuiteCRM
How to mitigate CVE-2026-33289
Install security update from vendor's website.
SuiteCRM - update to 7.15.1