CVE-2026-29099: SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the retrieve() function in include/OutboundEmail/OutboundEmail.php fails to properly neutralize the user controlled $id parameter. It is assumed that the function calling retrieve() will appropriately quote and sanitize the user input. However, two locations have been identified that can be reached through the EmailUIAjax action on the Email() module where this is not the case. As such, it is possible for an authenticated user to perform SQL injection through the retrieve() function. This affects the latest major versions 7.15 and 8.9. As there do not appear to be restrictions on which tables can be called, it would be possible for an attacker to retrieve arbitrary information from the database, including user information and password hashes. Versions 7.15.1 and 8.9.3 patch the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29099?
CVE-2026-29099 is classified as a medium-severity vulnerability due to its potential impact on data integrity.
How do I fix CVE-2026-29099?
To resolve CVE-2026-29099, upgrade SuiteCRM to versions 7.15.1 or 8.9.3 or newer.
What impact does CVE-2026-29099 have on my data?
CVE-2026-29099 allows for authenticated blind SQL injection, which could lead to unauthorized access to sensitive data.
Which versions of SuiteCRM are affected by CVE-2026-29099?
Versions prior to SuiteCRM 7.15.1 and 8.9.3 are vulnerable to CVE-2026-29099.
Is my installation of SuiteCRM safe from CVE-2026-29099?
If you are running SuiteCRM version 7.15.1 or 8.9.3 or later, your installation is not vulnerable to CVE-2026-29099.