CVE-2026-69135: SuiteCRM: Authenticated SQL Injection In Project Module
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to SuiteCRM and able to send a request to the Project module containing the duplicateId POST parameter. No user interaction is required.
Which deployments need updating?
SuiteCRM versions earlier than 7.15.2 and earlier than 8.10.2 are affected. Deployments running 7.15.2 or 8.10.2 or later in their respective release lines contain the fix.
What is the likely impact of successful exploitation?
An authenticated attacker can alter the structure of a SQL query and disclose sensitive information from the database. The supplied severity vector also indicates high confidentiality impact and low integrity impact.