SQL injection in SuiteCRM - CVE-2026-69134
Published: August 6, 2026
Vulnerability identifier: #VU141078
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69134
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL commands.
The vulnerability exists due to SQL injection in the REST v4 API relationship management handler when processing crafted relationship field values from rest_data. A remote user can send a specially crafted API request to execute arbitrary SQL commands.
The issue arises because request data is read from an unsanitized copy of user input before the securexss() filter runs, and affects methods receiving rest_data, including set_relationship.
Affected software
SuiteCRM
How to mitigate CVE-2026-69134
Install security update from vendor's website.
SuiteCRM - addressed in versions 7.15.2, 8.10.2