SQL injection in SuiteCRM - CVE-2026-61651
Published: August 1, 2026
Vulnerability identifier: #VU140688
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-61651
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to SQL injection in the get_end_date action in Projects Controller when handling the task_id parameter. A remote user can send a specially crafted request to disclose sensitive information and modify data.
The issue may be exploited using blind SQL injection techniques to enumerate database schema and dump database contents.
Affected software
SuiteCRM
How to mitigate CVE-2026-61651
Install security update from vendor's website.
SuiteCRM - addressed in versions 7.15.2, 8.10.2