CVE-2026-69136: SuiteCRM: Authenticated SQL Injection In handleAttachments function
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss() processing and directly interpolates its elements into an SQL UPDATE statement. An authenticated attacker can inject SQL to disclose database information or abuse the UPDATE context to soft-delete all records in the notes table in one request. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated SuiteCRM account and the ability to submit the remove_attachment POST parameter array during email template attachment handling. No user interaction is required.
Are default installations affected?
The issue affects SuiteCRM versions before 7.15.2 and 8.10.2 when email template attachment handling is reachable by an authenticated user. The provided information does not identify any additional configuration prerequisite.
What is the impact of successful exploitation?
An attacker can inject SQL to disclose database information. They can also abuse the UPDATE context to soft-delete all records in the notes table in a single request.
What versions address the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2, depending on the release branch in use. The issue is fixed in those versions.